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SUPPLY  CHAIN  SECURITY 

U.S.  Customs  and  Border  Protection  Has  Enhanced 
Its  Partnership  with  Import  Trade  Sectors,  but 
Challenges  Remain  in  Verifying  Security  Practices 


Why  GAO  Did  This  Study 


What  GAO  Found 


U.S.  Customs  and  Border 
Protection  (CBP)  is  responsible  for 
ensuring  the  security  of  cargo 
containers  shipped  into  the  United 
States.  To  strike  a  balance 
between  security  and  commerce, 
CBP  oversees  the  Customs-Trade 
Partnership  Against  Terrorism,  or 
C-TPAT  program.  As  part  of  this 
program,  CBP  aims  to  secure  the 
supply  chain — the  flow  of  goods 
from  manufacturers  to  retailers — 
through  partnerships  with 
international  trade  companies. 
Member  companies  agree  to  allow 
CBP  to  validate  their  security 
practices  and,  in  exchange,  they 
are  awarded  benefits,  such  as 
reduced  scrutiny  of  their  cargo.  In 
2005,  GAO  reviewed  the  C-TPAT 
program  and  noted  operational 
challenges.  For  this  report,  GAO 
was  asked  to  assess  the  progress 
CBP  has  made  since  2005  in  (1) 
improving  its  benefit  award 
policies  for  C-TPAT  members,  (2) 
addressing  challenges  in  validating 
members’  security  practices,  and 
(3)  addressing  management  and 
staffing  challenges.  To  perform  this 
work,  GAO  analyzed  a 
nonprobability  sample  of 
completed  validations;  reviewed 
annual,  human  capital,  and 
strategic  plans;  and  held 
discussions  with  CBP  officials. 


What  GAO  Recommends 


GAO  is  recommending  that  CBP 
improve  its  electronic  validation 
instrument,  improve  the  validation 
process,  enhance  its  records 
management  system,  and  establish 
performance  measures  for 
improving  supply  chain  security. 
CBP  concurred  with  each  of  the 
recommendations. 

To  view  the  full  product,  including  the  scope 
and  methodology,  click  on  GAO-08-240. 

For  more  information,  contact  Stephen 
Caldwell  at  (202)  512-8777  or 
caldwells@gao.gov. 


CBP  has  strengthened  its  policies  for  granting  benefits  to  importers,  C-TPAT’s 
largest  member  sector,  and  is  working  to  improve  its  policies  for  members  in 
other  trade  sectors.  For  example,  starting  in  March  2005,  CBP  began  requiring 
members  in  9  out  of  the  10  trade  sectors  to  meet  minimum  security  criteria 
and  it  plans  to  finalize  criteria  for  the  tenth  trade  sector  by  mid-2008.  CBP  has 
also  introduced  a  process  that  awards  benefits  for  C-TPAT  importers  on  a 
three-tiered  basis,  depending  on  validation  of  their  security  practices.  CBP 
officials  told  us  that  they  interpret  the  benefit  tiering  provisions  of  the 
Security  and  Accountability  for  Every  Port  Act  of  2006  to  apply  mainly  to 
importers.  Nevertheless,  CBP  considered  implementing  tiered  benefits  for 
other  trade  sectors,  but  it  has  not  been  able  to  identify  additional  benefits  to 
offer  nonimporters  in  a  tiered  structure. 

CBP  has  taken  steps  to  improve  the  security  validation  process,  but  still  faces 
challenges  in  verifying  that  C-TPAT  members’  security  practices  meet 
minimum  criteria.  CBP  has  sought  to  strengthen  the  validation  process  by 
providing  appropriate  guidance  and  developing  a  portable,  electronic 
instrument  to  help  ensure  that  validation  information  is  consistently  collected, 
documented,  and  uniformly  applied  to  decisions  regarding  the  awarding  of 
benefits  to  C-TPAT  members.  However,  the  usefulness  of  the  instrument  is 
limited  due  to  its  default  “no”  responses.  Specifically,  if  a  response  is  marked 
“no,”  it  is  unclear  whether  a  security  specialist,  who  has  the  discretion  to 
answer  or  not  answer  individual  questions,  intentionally  answered  the 
question  or  if  the  response  was  an  automatic  default.  This  factor  limits  the 
ability  of  CBP  to  validate  security  practices  at  member  companies. 

CBP  has  taken  actions  to  address  C-TPAT  management  and  staffing 
challenges,  such  as  implementing  a  human  capital  plan,  a  records 
management  system,  and  performance  measures.  While  these  actions  have 
addressed  a  number  of  challenges,  others  remain.  In  particular,  CBP’s  records 
management  system  does  not  include  interim  processing  dates — such  as  the 
date  that  security  specialists  send  companies  the  30-day  validation 
notification  letter — to  enable  management  or  others  to  determine  CBP’s 
compliance  with  program  requirements.  Further,  although  CBP  has 
developed  performance  measures  for  facilitating  the  flow  of  commerce,  it  has 
not  developed  performance  measures  to  assess  the  effectiveness  of  C-TPAT's 
efforts  to  improve  supply  chain  security. 
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Abbreviations 


ATS 

Automated  Targeting  System 

CBP 

Customs  and  Border  Protection 

CSI 

Container  Security  Initiative 

C-TPAT 

Customs-Trade  Partnership  Against  Terrorism 

DHS 

Department  of  Homeland  Security 
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Free  and  Secure  Trade 
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Government  Performance  and  Results  Act 
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nonintmsive  inspection 

SAFE  Port  Act 

Security  and  Accountability  for  Every  Port  Act 
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supply  chain  security  specialist 

VS  AT 

Validation  Security  Assessment  Tool 

WMD 

weapon  of  mass  destruction 
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United  States  Government  Accountability  Office 
Washington,  DC  20548 


April  25,  2008 
Congressional  Requesters 

In  fiscal  year  2007,  more  than  11  million  oceangoing  cargo  containers 
carrying  goods  were  offloaded  at  U.S.  seaports.  Facilitating  the  free  flow 
of  these  goods  while  ensuring  that  the  containers  do  not  pose  a  threat  to 
homeland  security — whether  by  carrying  weapons  of  mass  destruction 
(WMD)  or  other  dangerous  materials — remains  one  of  many  challenges 
facing  the  Department  of  Homeland  Security  (DHS). 

In  an  effort  to  strike  a  balance  between  the  need  for  security  and  free- 
flowing  maritime  commerce,  U.S.  Customs  and  Border  Protection  (CBP) — 
a  component  of  DHS  responsible  for  protecting  the  nation’s  borders  at  and 
between  official  ports  of  entry — oversees  the  Customs-Trade  Partnership 
Against  Terrorism  program,  known  as  C-TPAT.1  CBP’s  port  of  entry 
responsibilities  encompass  326  airports,  seaports,  and  designated  land 
borders.  C-TPAT,  which  applies  across  all  transportation  modes,  is  a 
component  of  CBP’s  multifaceted  approach  for  overseeing  the  security  of 
containerized  cargo  and  the  international  supply  chain — the  flow  of  goods 
from  foreign  manufacturers,  suppliers,  or  vendors  where  such  shipments 
originate  to  retailers.  CBP’s  strategy  also  includes  the  following: 

•  Advance  information:  Under  its  “24-hour  Rule,”  CBP  requires  that 
carriers  present  complete  vessel  containerized  cargo  declarations  to 
CBP  24  hours  before  loading  such  cargo  aboard  a  vessel  at  foreign 
ports  bound  for  the  United  States. 

•  Automated  advanced  targeting:  CBP  officers  evaluate  cargo 
information  forwarded  from  carriers  before  its  arrival  in  the  United 
States  using  the  Automated  Targeting  System  (ATS).  The  system,  using 
a  rules-based  program,  allows  for  uniform  review  of  cargo  shipments  to 
identify  the  highest  risk  shipments,  and  presents  data  in  a  format  to 
permit  CBP  officers  to  address  specific  intelligence  threats  and  trends. 

•  Use  of  non-intrusive  inspection  (Nil)  technology  and  mandatory  exams 
for  all  high-risk  shipments:  CBP  has  deployed  detection  technologies  to 
our  nation’s  sea,  air,  and  land  border  ports  of  entry  that  include  large- 


1  Ports  of  entry  are  government-designated  locations  where  CBP  inspects  persons  and 
goods  to  determine  whether  they  may  be  lawfully  admitted  into  the  country. 
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scale  X-  ray  and  gamma-imaging  systems  as  well  as  a  variety  of 
portable  and  hand-held  technologies  to  enable  CBP  to  inspect  a  larger 
portion  of  commercial  traffic. 

•  Container  Security  Initiative  (CSI):  Through  CSI,  CBP  places  staff  at 
designated  foreign  seaports  to  work  with  its  foreign  counterparts  to 
inspect  high-risk  cargo  for  WMD  before  the  cargo  is  shipped  to  the 
United  States.2 

CBP  initiated  C-TPAT  as  part  of  its  strategy  in  November  2001.  C-TPAT 
aims  to  secure  the  flow  of  goods  bound  for  the  United  States  by 
developing  a  voluntary  antiterrorism  partnership  with  stakeholders  of  the 
international  trade  community  comprised  of  importers;  customs  brokers; 
air,  sea,  and  land  carriers;  and  other  logistics  service  providers  such  as 
freight  consolidators  and  nonvessel  common  carriers.  To  join  C-TPAT,  a 
company  submits  a  narrative  security  profile  which  CBP  compares  to  its 
minimum  security  requirements  for  the  company’s  trade  sector.  In  what  is 
referred  to  as  vetting,  CBP  then  reviews  the  company’s  compliance  with 
customs  laws  and  regulations  and  reviews  any  violation  history  to  identify 
information  that  might  preclude  approval  of  benefits.  Once  any  omissions, 
such  as  failure  to  address  criteria,  or  other  issues  are  resolved  to  CBP’s 
satisfaction,  CBP  accepts  the  company’s  agreement  to  voluntarily 
participate  in  C-TPAT  and  the  company  becomes  a  certified  C-TPAT 
member.  Companies  that  join  the  program  commit  to  improving  the 
security  of  their  supply  chain  and  agree  to  provide  CBP  with  information 
on  their  specific  security  measures.  In  addition,  the  companies  agree  to 
allow  CBP  to  validate  or  verify,  among  other  things,  that  their  security 
measures  meet  or  exceed  the  agency’s  minimum  security  requirements. 

The  purpose  of  this  latter  step,  referred  to  as  validation,  is  to  help  CBP 
ensure  that  the  security  measures  outlined  in  a  member’s  security  profile 
are  actually  in  place  and  effective.3  In  return,  C-TPAT  members  are  entitled 
to  various  benefits — chief  among  them,  a  reduced  likelihood  of  scrutiny  of 
their  cargo.  As  of  the  end  of  2007,  CBP  had  awarded  initial  C-TPAT 
certification  to  7,948  companies  that  accounted  for  approximately  30 


2  For  a  further  discussion  of  CSI,  see  GAO,  Supply  Chain  Security:  Examinations  of 
High-Risk  Cargo  at  Foreign  Seaports  Have  Increased,  but  Improved  Data  Collection  and 
Perforrmance  Measures  Are  Needed,  GAO-08-187  (Washington,  D.C.:  Jan.  25,  2008). 

3  Member  companies’  security  practices  are  to  be  revalidated  every  3  years. 
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percent  of  all  U.S.  imports.4  In  addition,  by  the  end  of  2007,  CBP  had 
validated  the  security  of  79  percent  of  certified  C-TPAT  members. 

In  October  2006,  the  Security  and  Accountability  for  Every  Port  (or  SAFE 
Port)  Act  of  2006  established  a  statutory  framework  for  the  C-TPAT 
program.5  In  addition  to  formally  establishing  C-TPAT  as  a  voluntary 
government-private  sector  program  to  strengthen  and  improve  the  overall 
security  of  the  international  supply  chain,  the  act  codified  existing 
membership  processes  for  C-TPAT  and  added  new  components,  such  as 
time  frames  for  certifying,  validating,  and  revalidating  members’  security 
practices.  In  addition,  CBP — in  recognition  of  the  growing 
interdependence  of  nations  that  requires  policymakers  to  work  in 
partnerships  across  boundaries  to  achieve  vital  national  goals — has 
engaged  in  outreach  efforts  through  the  World  Customs  Organization  to 
improve  the  security  of  international  trade  by  promoting  an  international 
framework  of  standards  governing  customs  and  related  business 
relationships.6  These  efforts  have  made  C-TPAT  a  focal  point  for  other 
countries  wanting  to  establish  similar  customs-to-business  partnership 
programs  or,  having  programs,  seeking  reciprocal  arrangements  whereby 
one  country  can  attain  a  certain  level  of  assurance  about  and  accept  the 
customs  security  standards  and  practices  and  business  partnership 
programs  of  another  country.  This  attention  places  an  added  responsibility 
on  CBP  to  effectively  manage  the  C-TPAT  program. 

Our  prior  work  on  C-TPAT  has  acknowledged  that  while  the  C-TPAT 
program  holds  promise  as  part  of  a  maritime  security  strategy,  it  has  faced 
management  and  operational  challenges.  In  March  2006,  for  instance,  we 
reported  on  weaknesses  in  CBP’s  approach  to  validating  C-TPAT  members 
seeking  to  take  advantage  of  the  program’s  benefits.7  In  particular,  we 
reported  that  these  weaknesses  compromised  CBP’s  ability  to  verify  that 
supply  chain  security  measures,  described  in  security  information 


4  According  to  CBP’s  Executive  Director,  Cargo  and  Conveyance  Security,  C-TPAT 
members  include  other  transportation  modes  in  addition  to  seagoing  vessels  and,  as  a 
whole,  accounted  for  46  percent  of  imported  containerized  cargo  as  of  September  2007. 

5  Pub.  L.  No.  109-347,  120  Stat.  1884  (2006). 

6  The  World  Customs  Organization  is  an  international  organization  aimed  at  enhancing  the 
effectiveness  and  efficiency  of  customs  administrations.  We  plan  to  report  in  the  spring  of 
2008  on  our  ongoing  review  of  CBP’s  role  in  promoting  international  standards. 

7  GAO,  Cargo  Security:  Partnership  Program  Grants  Importers  Reduced  Scrutiny  with 
Limited  Assurance  of  Improved  Security,  GAO-05-404  (Washington,  D.C.:  Mar.  11,  2005). 


Page  3 


GAO-08-240  Supply  Chain  Security 


submitted  by  program  members,  were  accurately  reported  and  followed. 

In  our  July  2003  report,  we  identified  other  challenges  with  C-TPAT, 
including  that  the  program  lacked  adequate  performance  measures  and  a 
human  capital  plan  indicating  how  CBP  intended  to  develop  new  staff  to 
meet  the  program’s  growing  demands.8 

Recognizing  the  importance  of  the  C-TPAT  program,  you  asked  us  to 
conduct  another  review.  For  this  report,  we  updated  information  from  our 
2005  report  and  addressed  the  following  questions: 

•  What  has  CBP  done  to  strengthen  its  policies  for  awarding  benefits  to 
companies  that  participate  in  C-TPAT  in  response  to  our  2005  report? 

•  What  progress  has  CBP  made  in  addressing  challenges  in  its  processes 
for  validating  C-TPAT  companies’  security  processes  that  we  identified 
in  our  2005  report? 

•  What  actions  has  CBP  taken  since  2005  to  address  overall  management 
and  staffing  challenges  of  the  C-TPAT  program  and  ensure  that  the 
program  operates  as  intended? 

To  address  the  first  objective,  we  reviewed  CBP’s  minimum  security 
criteria  and  discussed  its  development  with  CBP  and  C-TPAT  program 
officials.  We  also  reviewed  CBP’s  benefits  for  C-TPAT  importers  and 
subsequent  requirements  under  the  SAFE  Port  Act  for  granting  benefits  to 
C-TPAT  participants.  To  address  the  second  objective,  we  reviewed  a 
nonprobability  sample  of  25  validations  completed  from  March  1,  2006, 
through  September  30,  2006.  Our  review  included  examining  hard  copy 
records  and  other  data,  such  as  comments  or  observations  made  by 
security  specialists.  The  results  of  this  review  are  not  generalizable. 
However,  because  we  selected  the  validation  cases  based  on  the  variety  of 
their  field  office  location,  role  in  the  supply  chain,  use  and  nonuse  of 
CBP’s  automated  validation  instrument,  and  type  of  validation 
questionnaire  used,  they  provided  us  an  overall  understanding  of  the 
validation  activities  and  documents  that  are  collected  during  validation 
site  visits.  In  CBP  field  locations  where  we  performed  the  reviews,  we  also 
discussed  the  validation  process  with  11  supply  chain  security  specialists 
who  conduct  C-TPAT  validations.  These  specialists  were  selected  based 


8  GAO,  Container  Security:  Expansion  of  Key  Customs  Programs  Will  Require  Greater 
Attention  to  Critical  Success  Factors,  GAO-03-770  (Washington,  D.C.:  July  25,  2003). 
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on  their  availability  and  their  views  are  not  generalizable  beyond  the 
group.  Nonetheless,  because  the  specialists  were  selected 
nonsystematically  and  by  chance  and  included  a  wide  range  of  experience 
in  the  specialist  position,  their  interview  statements  provided  broad-based, 
realistic  personal  descriptions  of  what  occurs  in  CBP’s  validation  process 
for  C-TPAT  members.  We  also  obtained  information  on  and  reviewed 
CBP’s  application  of  an  automated  instrument  that  CBP  developed  for  use 
in  the  validation  process.  In  addition,  we  compared  the  criteria  for 
importers  to  the  three  questionnaires  used  in  the  validation  process.  To 
address  the  third  objective,  we  reviewed  documentation  on  C-TPAT 
Portal — CBP’s  newly  implemented  records  management  system — and  C- 
TPAT’s  2007  annual  plan,  2005  human  capital  plan,  and  2004  strategic  plan. 
We  supplemented  our  document  reviews  with  discussions,  as  appropriate, 
with  agency  officials. 

We  conducted  this  performance  audit  from  May  2006  to  April  2008  in 
accordance  with  generally  accepted  government  auditing  standards.  Those 
standards  require  that  we  plan  and  perform  the  audit  to  obtain  sufficient, 
appropriate  evidence  to  provide  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives.  We  believe  that  the  evidence 
obtained  provides  a  reasonable  basis  for  our  findings  and  conclusions 
based  on  our  audit  objectives.  A  more  detailed  discussion  of  our  scope  and 
methodology  is  contained  in  appendix  I. 


Results  in  Brief 


In  response  to  our  March  2005  recommendations  and  in  accordance  with 
the  SAFE  Port  Act,  CBP  has  strengthened  its  policies  for  granting  benefits 
to  importers — C-TPAT’s  largest  member  sector — and  has  efforts  underway 
to  improve  its  policies  for  granting  benefits  to  C-TPAT  members  in  other 
sectors.  For  example,  between  March  2005  and  November  2007,  CBP 
established  requirements  for  C-TPAT  members  in  nine  trade  sectors  to 
meet  minimum  security  criteria  for  their  specific  trade  sector,  including 
importers  and  C-TPAT  members  in  eight  trade  sectors  other  than 
importers:  sea  carriers;  highway  carriers;  rail  carriers;  air  carriers;  foreign 
manufacturers;  U.S.  customs  brokers;  U.S.  and  foreign  maritime  port 
authorities  and  terminal  operators;  and  long  haul  highway  carriers  in 
Mexico.  In  addition,  CBP  is  finalizing  criteria  for  the  one  remaining  trade 
sector — freight  consolidators/ocean  transportation  intermediaries  and 
nonvessel  operating  common  carriers — and  plans  to  issue  the  criteria  by 
mid-2008.  CBP  has  also  introduced  a  “tiered”  benefits  process,  as  provided 
in  the  SAFE  Port  Act,  for  C-TPAT  importers,  which  account  for  about  48 
percent  of  C-TPAT’s  members.  CBP  awards  importers  benefits  on  a  three¬ 
tiered  basis,  depending  in  part  on  CBP’s  validation  of  the  importers’ 
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sustained  commitment  to  implementing  certain  supply  chain  security 
practices.  CBP  has  not  established  the  tiered  benefits  structure  for  the 
other  C-TPAT  trade  sectors — about  52  percent  of  C-TPAT’s  members. 
Rather,  it  grants  these  trade  sectors  certain  benefits  such  as  access  to 
other  C-TPAT  members  and  attendance  at  CBP-sponsored  security 
training  upon  their  certification  into  the  program.  CBP  officials  told  us 
that  they  interpret  the  benefit  tiering  provisions  of  the  Safe  Port  Act  to 
apply  mainly  to  importers.  Nevertheless,  CBP  has  considered 
implementing  tiered  benefits  for  these  other  trade  sectors,  but  it  has  not 
been  able  to  identify  additional  benefits  to  offer  nonimporters  in  a  tiered 
structure. 

CBP  has  taken  steps  to  improve  the  C-TPAT  security  validation  process, 
but  remains  challenged  to  verify  that  C-TPAT  members  have  security 
practices  consistent  with  the  minimum  security  criteria  established  for 
their  particular  trade  sector.  First,  there  are  problems  with  the  portable, 
personal  computer-based  data-gathering  instrument  that  CBP  has  provided 
to  its  security  specialists  to  help  ensure  that  validation  information  is 
consistently  collected,  documented,  and  uniformly  applied  to  decisions 
regarding  the  awarding  of  benefits  to  C-TPAT  members.  The  SAFE  Port 
Act  requires  that  CBP  have  internal  controls  to  provide  a  standardized 
work  program  for  executing  validations  and  other  C-TPAT  processes; 
however,  we  found  that  the  instrument’s  design  does  not  result  in  a 
consistent  validation  process.  In  particular,  we  found  that  the  usefulness 
of  the  instrument  is  limited  by  the  fact  that  it  provides  default  “no” 
responses.  For  example,  if  a  response  is  marked  “no,”  it  is  unclear  whether 
a  security  specialist,  who  has  the  discretion  to  answer  or  not  answer 
individual  questions,  intentionally  answered  the  question  or  if  the 
response  was  an  automatic  default.  Second,  while  the  validation 
instrument  allows  specialists  an  opportunity  to  collect  data  on  the  results 
of  members’  internal  or  third-party  audits  and  inspections  of  their  supply 
chain  security  practices,  CBP  does  not  require  security  specialists  to  use 
these  data  in  validating  members’  security  practices  as  an  alternative  to 
direct  testing,  even  though  CBP  views  direct  testing  as  impractical.  Third, 
our  work  shows  that  CBP  lacks  a  systematic  process  to  ensure 
appropriate  actions  are  taken  in  response  to  security  specialists’ 
recommendations  in  validation  reports.  Without  such  a  key  internal 
control,  CBP  does  not  have  reasonable  assurance  that  companies 
implement  its  recommendations  to  enhance  supply  chain  security 
practices  in  accordance  with  CBP  criteria.  Until  CBP  overcomes  these 
collective  challenges,  CBP  will  be  unable  to  assure  Congress  and  others 
that  C-TPAT  member  companies  that  have  been  granted  reduced  scrutiny 
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of  their  U.S.-bound  containerized  shipments  actually  employ  adequate 
security  practices. 

CBP  has  taken  a  number  of  actions  to  address  C-TPAT  management  and 
staffing  challenges,  but  continues  to  confront  issues  in  effectively 
managing  the  program.  To  strengthen  C-TPAT  program  management,  CBP, 
among  other  things,  developed  a  human  capital  plan,  implemented  a 
records  management  system  for  documenting  program  decisions,  and  put 
additional  performance  measures  in  place.  In  addition  to  developing  a 
human  capital  plan  to  address  C-TPAT  staffing  challenges,  CBP  increased 
the  number  of  supply  chain  security  specialists,  and  projected  its  resource 
needs  in  light  of  additional  workload  requirements  included  in  the  SAFE 
Port  Act.  CBP  believes  its  current  staffing  level  will  allow  it  to  meet  the 
act’s  requirements  through  2009.  CBP  also  developed  and  implemented 
C-TPAT  Portal — a  centralized  electronic  records  management  system  to 
facilitate  information  storage  and  sharing  and  communication  with 
C-TPAT  members.  This  system  provides  CBP  capability  to  track  the  status 
of  C-TPAT  applicants  and  members  to  ensure  that  they  are  certified, 
validated,  and  revalidated  in  accordance  with  SAFE  Port  Act 
requirements.  However,  certain  data  are  missing  from  Portal,  including 
interim  processing  dates,  such  as  the  date  the  security  specialist  sends 
members  the  30-day  validation  notification  letter,  and  this  inhibits 
management’s  ability  to  determine  compliance  with  its  requirements  for 
managing  and  operating  the  C-TPAT  program.  This  lack  of  data  also 
precluded  us  from  fully  assessing  a  sample  of  C-TPAT  members’  records 
to  determine  compliance  with  the  program’s  requirements,  thus  not 
meeting  internal  control  standards  that  documentation  should  be  readily 
available  for  examination.  Finally,  CBP’s  efforts  to  develop  C-TPAT 
program  performance  measures  have  focused  on  program  administration 
and  participation,  and  the  internationalization  of  C-TPAT  principles. 
However,  the  difficulty  of  determining  the  deterrent  effect  of  security 
practices  continues  to  challenge  CBP  in  seeking  outcome-based 
performance  measures  for  the  effectiveness  of  C-TPAT’s  efforts  to  ensure 
improved  supply  chain  security.  For  example,  CBP  has  not  collected  data 
on  the  results  of  C-TPAT  members’  actions  to  enhance  supply  chain 
security.  Moreover,  the  lack  of  security-specific  performance  measures 
limits  CBP’s  ability  to  evaluate  progress  for  this  program  goal. 
Nevertheless,  CBP  remains  subject  to  the  requirement  that  federal 
agencies  develop  outcome-based  performance  measures  to  assess 
program  results. 

We  are  making  recommendations  to  the  Secretary  of  Homeland  Security  to 
direct  the  Commissioner  of  U.S.  Customs  and  Border  Protection  to 
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improve  CBP’s  implementation  of  SAFE  Port  Act  provisions  and  its  ability 
to  meet  C-TPAT  program  goals  by:  (1)  revising  the  electronic  instrument 
used  in  validations  to  include  appropriate  response  options  and  eliminate 
the  use  of  default  “no  “  responses;  (2)  requiring  validations  to  include  the 
review  and  assessment  of  any  available  results  from  audits,  inspections,  or 
other  reviews  of  a  member’s  supply  chain  security;  (3)  ensuring  that 
C-TPAT  validation  report  recommendations  are  implemented  by 
establishing  a  policy  for  security  specialists  to  follow  up  with  member 
companies  when  CBP  requires  them  to  make  security  enhancements  to 
ensure  that  the  necessary  steps  are  taken;  (4)  enhancing  the  C-TPAT 
records  management  system  to  completely  document  key  data  elements 
needed  to  track  compliance  with  SAFE  Port  Act  and  other  CBP  internal 
requirements;  and  (5)  identify  and  pursue  opportunities  in  information 
collected  during  C-TPAT  member  processing  activities  that  may  provide 
direction  for  developing  performance  measures  of  enhanced  supply  chain 
security. 

We  provided  a  draft  of  this  report  to  the  Secretary  of  Homeland  Security 
for  review  and  comment.  We  received  comments  from  DHS  and  CBP  that 
are  reprinted  in  appendix  III.  DHS  and  CBP  agreed  with  our 
recommendations  and  outlined  actions  that  CBP  plans  to  take  to 
implement  them.  CBP  also  provided  technical  comments,  which  we  have 
incorporated  into  the  report  as  appropriate. 


Background 


Vulnerability  Of  the  Supply  Supply  chain  security  is  a  principal  element  in  the  U.S.  layered  strategy  to 
Chain  protect  maritime  commerce.  In  the  post  9/11  environment,  the  movement 

of  cargo  containers  in  a  supply  chain  from  foreign  manufacturers, 
suppliers,  or  vendors  to  retailers  in  the  United  States  is  vulnerable  to 
terrorist  action.  Several  studies  of  maritime  security  conducted  by  federal, 
academic,  nonprofit,  and  business  organizations  have  identified 
vulnerability  in  the  movement  of  oceangoing  cargo  in  containers.  Every 
time  responsibility  for  cargo  in  containers  changes  hands  along  the  supply 
chain  there  is  the  potential  for  a  security  breach;  thus,  vulnerabilities  exist 
that  terrorists  could  exploit  by,  for  example,  placing  a  WMD  into  a 
container  for  shipment  to  the  United  States  or  elsewhere.  While  there  have 
been  no  known  incidents  of  containers  being  used  to  transport  WMD, 
criminals  have  exploited  containers  for  other  illegal  purposes,  such  as 
smuggling  weapons,  people,  and  illicit  substances.  Finally,  while  CBP  has 
noted  that  the  likelihood  of  terrorists  smuggling  WMD  into  the  United 
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States  in  cargo  containers  is  low,  the  nation’s  vulnerability  to  this  activity 
and  the  consequences  of  such  an  attack  are  potentially  high.  For  example, 
in  2002,  Booz  Allen  Hamilton  sponsored  a  simulated  scenario  in  which  the 
detonation  of  weapons  smuggled  in  cargo  containers  shut  down  all  U.S. 
seaports  for  12  days.  The  results  of  the  simulation  estimated  that  the 
seaport  closures  could  result  in  a  loss  of  $58  billion  in  revenue  to  the  U.S. 
economy  along  with  significant  disruptions  to  the  movement  of  trade. 

According  to  research  initiated  by  the  U.S.  Department  of  Transportation’s 
Volpe  National  Transportation  Systems  Center,  cargo  security  is  affected 
by  the  number  of  individual  companies  contracted  to  facilitate  the 
movement  of  cargo  through  its  supply  chain.9  The  National  Strategy  for 
Maritime  Security  stated  that  the  complexity  of  the  process  for  handling 
containerized  shipments  makes  it  more  difficult  to  embed  security 
practices  and  reduce  vulnerabilities  than  for  other  types  of  cargo.10 
Container  ships  carry  cargo  for  thousands  of  companies  and  the 
containers  are  loaded  individually  away  from  the  port.  Each  transfer  of  a 
container  from  one  party  to  the  next  is  a  point  of  vulnerability  in  the 
supply  chain.  The  security  of  each  transfer  facility  and  the  trustworthiness 
of  each  company  are,  therefore,  critical  to  the  overall  security  of  the 
shipment.  Cargo  must  be  loaded  in  containers  at  secure  facilities  and  the 
integrity  of  the  container  must  be  maintained  to  its  final  destination.  In 
addition,  supply  chain  personnel  need  to  employ  various  methods  to 
prevent  the  misuse  of  containers  and  conveyances  for  transporting  WMD 
and  other  illegal  commodities,  as  well  as  to  detect  tampering.  Further, 
supply  chain  personnel  are  to  report  any  unlawful  incidents  to  DHS  and, 
when  appropriate,  resolve  such  incidents  prior  to  the  arrival  of  the 
identified  containers  in  the  United  States.  Therefore,  embedding  security 
practices  and  vulnerability  reduction  efforts  into  commercial  practices  for 
all  key  points  in  the  international  supply  chain  using  oceangoing  cargo 
containers — shown  in  figure  1 — rests  upon  implementing,  among  other 
things,  customs-to-business  partnerships,  such  as  C-TPAT. 


9  Department  of  Transportation  Volpe  National  Transportation  Systems  Center,  Intermodal 
Cargo  Transportation:  Industry  Best  Security  Practices  (Cambridge,  Mass.:  June  2002). 

10  The  National  Strategy  for  Maritime  Security  (September  2005).  The  document  is  guided 
by  the  objectives  and  goals  contained  in  the  National  Security  Strategy  and  the  National 
Strategy  for  Homeland  Security. 
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Figure  1:  Key  Points  in  the  International  Supply  Chain  Using  Oceangoing  Cargo  Containers 
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Source:  GAO. 


C-TPAT  Program  Structure  and  CBP  conducts  C-TPAT  as  a  voluntary  partnership  program  between  the 
Membership  business  community  and  CBP,  designed  to  enhance  the  security  of 

international  supply  chains  to  the  United  States,  thus  helping  CBP  to 
achieve  its  goals  of  homeland  security  and  facilitation  of  trade  by  reducing 
the  number  of  containers  that  otherwise  might  be  screened  for  WMD 
because  of  risk  considerations.  CBP  uses  C-TPAT  to  pursue  these  goals  by 
encouraging  importers,  freight  forwarders,  carriers,  and  other  import 
logistics  service  companies  to  improve  their  security  practices  and  to 
persuade  their  international  supply  chain  service  providers — companies 
operating  overseas  and  outside  CBP’s  jurisdiction — to  do  the  same.  CBP 
accomplishes  this  through  partnership  agreements  and  by  reviewing 
C-TPAT  members’  security  practices.  As  a  first  step  in  C-TPAT 
membership,  a  company  must  sign  an  agreement  with  CBP  signifying  its 
commitment  to  enhance  its  supply  chain  security  consistent  with  C-TPAT 
minimum  security  criteria  and  to  work  with  its  service  providers  to 
enhance  security  throughout  its  supply  chain  to  the  United  States.  The 
partnership  agreements  that  C-TPAT  members  sign  provide  CBP  with  the 
authority  it  needs  to  conduct  the  program,  including  validating  members’ 
security  practices  and  assessing  the  results  of  audits  and  internal  reviews 
of  member  companies. 

Under  C-TPAT,  CBP  officials  work  with  private  companies  to  review  their 
supply  chain  security  plans  and  improve  members’  overall  security.  In 
return,  C-TPAT  members  may  receive  benefits,  such  as  reduced  scrutiny 
or  expedited  processing  of  their  shipments.  CBP  data  show  that  from  2004 
through  2006,  C-TPAT  members  were  responsible  for  importing  about  30 
percent  of  U.S.-bound  cargo  containers,  and  specifically  imported  29.6 
percent  of  the  11.7  million  oceangoing  cargo  containers  arriving  at  and 
offloaded  in  the  United  States  during  the  first  9  months  of  2007.  In 
September  2007,  CBP  had  over  7,000  C-TPAT  members  from  the  import 
trade  community  that  had  various  roles  in  the  supply  chain,  as  described 
in  table  1.  Importers,  at  48  percent,  were  the  largest  C-TPAT  member 
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group  and,  as  shown  in  figure  2,  the  remainder  of  about  52  percent  was 
distributed  among  nine  other  sectors  that  participate  in  international 
supply  chains  as  business  partners  to  importers. 


Figure  2:  Percent  of  C-TPAT  Members  by  Trade  Sector,  as  of  September  30,  2007 


Note:  Percentages  do  not  total  100  percent  due  to  rounding  and  the  exclusion  of  air  carriers  and  rail 
carriers,  each  of  which  accounted  for  less  than  1  percent  of  the  C-TPAT  program’s  membership. 

Other  trade  sectors  that  are  not  importers  serve  in  various  roles  as 
business  partners  to  importers  including  supplier,  manufacturer,  vendor, 
service  provider,  and  customer.  Nonimporters  participating  in  C-TPAT 
benefit  by  acquiring  status  as  a  “preferred  importer  business  partner,” 
which  is  a  company  that  importers  prefer  to  do  business  with  based  on  the 
company’s  known  acceptance  of  C-TPAT  security  requirements. 

According  to  CBP,  the  agency  wants  importing  companies  to  have  their 
business  partners  either  join  C-TPAT  or  adhere  to  C-TPAT  security 
requirements.  Table  1  describes  the  role  of  trade  community  members  in 
the  international  supply  chain. 
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Table  1:  Roles  of  Trade  Community  Members  in  the  Supply  Chain 

Trade  community  member 

Role  in  the  supply  chain 

Air/rail/sea  carriers 

Carriers  transport  cargo  via  air,  rail,  or  sea 

Border  highway  carriers 

Highway  carriers  transport  cargo  for  scheduled  and  unscheduled  operations  via  road 
across  the  Canadian  and  Mexican  borders. 

Importers 

Importers,  in  the  course  of  trade,  bring  articles  of  trade  from  a  foreign  source  into  a 
domestic  market. 

Licensed  customs  brokers 

Brokers  clear  goods  through  customs.  The  responsibilities  of  a  broker  include 
preparing  the  entry  form  and  filing  it,  advising  the  importer  on  duties  to  be  paid,  and 
arranging  for  delivery  to  the  importer. 

Freight  consolidators/ocean  transportation 
intermediaries  and  nonvessel-operating 
common  carriers 

A  freight  consolidator  is  a  firm  that  accepts  partial  container  shipments  from  individual 
shippers  and  combines  the  shipments  into  a  single  container  for  delivery  to  the  carrier. 

A  transportation  intermediary  facilitates  transactions  by  bringing  buyers  and  sellers 
together.  A  nonvessel-operating  common  carrier  is  a  company  that  buys  shipping 
space  through  a  special  arrangement  with  an  ocean  carrier  and  resells  the  space  to 
individual  shippers. 

Port  authorities/terminal  operators 

A  port  authority  is  an  entity  of  state  or  local  government  that  owns,  operates,  or 
otherwise  provides  wharf,  dock,  and  other  marine  terminal  investments  at  ports. 

Terminal  operator  responsibilities  include  the  overseeing  and  unloading  of  cargo  from 
ship  to  dock,  checking  the  actual  cargo  against  the  ship’s  manifest  (list  of  goods), 
checking  documents  authorizing  a  truck  to  pick  up  cargo,  overseeing  the  loading  and 
unloading  of  railroad  cars,  and  so  forth. 

Source:  GAO. 

CBP  hired  156  supply  chain  security  specialists  to  provide  services  for 
C-TPAT  members,  as  of  September  2007  to,  among  other  things,  review  the 
C-TPAT  applicants’  and  members’  security  practices.  The  security 
specialists  are  located  in  five  C-TPAT  field  offices:  Washington,  D.C.; 

Miami,  Florida;  Los  Angeles,  California;  Newark,  New  Jersey;  and  New 
York,  New  York.  Overall,  for  fiscal  year  2007,  the  C-TPAT  budget  was 
about  $55  million.  The  budget  for  fiscal  year  2008  was  about  $56  million, 
and  the  budget  for  fiscal  year  2009  is  also  about  $56  million. 

CBP’s  Multistep  Review 
Process  for  Accepting 
C-TPAT  Members 

CBP  has  a  multistep  review  process  for  accepting  businesses  as  members 
in  the  C-TPAT  program  and  granting  them  benefits.  As  described  in  figure 

3,  the  process  consists  of  five  steps:  application,  submission  of  a  security 
profile,  certification,  vetting,  and  validation. 
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Figure  3:  Overview  of  the  C-TPAT  Member  Acceptance  Process 
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Application 

Company  submits  information  and  agrees  to  voluntarily  participate  in  C-TPAT. 


Security  Profile 

Within  60  days  of  initial  application,  company  is  to  submit  a  supply  chain  security  profile  meeting  or  exceeding  C-TPAT’s 
minimum  security  criteria  for  the  company’s  trade  sector. 


Certification 


90-day  Review 


A 


CBP  is  to  review  the  company’s  supply  chain  security  profile  for  consistency  with  C-TPAT’s  minimum  security  criteria 
within  90  days  of  receipt,  to  the  extent  practicable. 


Vetting 


Benefits  Granted 


CBP  is  also  to  conduct  a  vetting  process  by  reviewing  the  compliance  with  customs  laws  and  regulations  and 
violation  history  of  the  company  to  identify  any  questionable  information  that  might  preclude  approval  of  benefits. 


If  the  review  is  favorable,  nonimporters  are  to  receive  benefits  such  as  an  assigned  CBP  liaison,  access  to  C-TPAT  partners, 
and  attendance  at  CBP  sponsored  training.  Importers  are  to  receive  Tier  1  reduced  inspection  benefits. 


Validation 


CBP  is  to  conduct  a  validation  of  certified  C-TPAT  partners  not  later  than  1  year  after  certification,  to  the  extent  practicable, 
to  ensure  they  have  implemented  the  security  outlined  in  their  supply  chain  security  profiles  and  any  supplemental  information 
provided  to  CBP. 

Importers  whose  security  measures  are  validated  receive  Tier  2  benefits  that  may  include  priority  searches  and  reduced 
cargo  examinations. 

If  validation  shows  sustained  commitment  beyond  what  is  minimally  expected,  the  importer  receives  Tier  3  benefits  such  as 
expedited  cargo  release  at  U.S.  ports  at  all  threat  levels,  further  reduction  in  cargo  examinations,  and  participation  in  joint 
incident  management  exercises.  Validated  nonimporters  receive  no  additional  benefits. 


c 


Tier  2  or  3  Benefits  Granted  Importers 


i 


Source:  GAO. 


Companies  first  complete  an  online  electronic  application  that  includes 
submission  of  corporate  information,  a  supply  chain  security  profile,  and 
an  acknowledgement  of  an  agreement  to  voluntarily  participate.  In 
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completing  the  supply  chain  security  profile,  companies  are  to  conduct  a 
comprehensive  self-assessment  of  their  supply  chain  security  procedures 
using  the  C-TPAT  security  criteria  or  guidelines  that  were  jointly 
developed  by  CBP  and  the  trade  community  for  their  specific  participant 
category — such  as  U.S.  importers  or  sea,  rail,  and  highway  carriers.  These 
security  profiles  are  to  summarize  the  applicant’s  current  security 
procedures  in  areas  such  as  container  security,  personnel  security,  and 
security  training  and  threat  awareness. 

CBP  next  uses  a  certification  process  to  review  a  new  company’s 
application  and  security  profile  by  comparing  their  contents  with  security 
criteria,  looking  for  any  weaknesses  or  gaps  in  security  procedures  as 
described  by  the  companies.  In  what  is  referred  to  as  vetting,  CBP  also 
reviews  the  company’s  compliance  with  customs  laws  and  regulations  and 
reviews  any  violation  history  to  identify  information  that  might  preclude 
approval  of  benefits.  Once  any  omissions  or  issues  are  resolved  to  CBP’s 
satisfaction,  CBP  accepts  the  company’s  agreement  to  voluntarily 
participate  in  C-TPAT  and  the  company  becomes  a  certified  C-TPAT 
member,  eligible  for  certain  program  benefits.  The  SAFE  Port  Act  refers  to 
certified  members  as  “Tier  1  participants”  and  provides  that  CBP  is  to  offer 
them  “limited  benefits,”  such  as  a  maximum  20  percent  reduction  in  the 
score  that  CBP  uses  in  identifying  cargo  for  inspection  that  arrives  at  U.S. 
ports. 

CBP’s  final  step  in  the  review  process  for  accepting  new  C-TPAT  members 
is  validating  that  the  security  measures  outlined  in  a  certified  member’s 
security  profile  are  reliable,  accurate,  and  effective.  Member  companies 
are  selected  for  validation  either  on  the  basis  of  (1)  a  risk  assessment; 

(2)  CBP’s  election  to  focus  on  a  particular  country,  industry,  or 
commodity;  (3)  CBP  headquarters’  direction  in  accordance  with  a 
mandate,  such  as  a  SAFE  Port  Act  requirement;  or  (4)  meeting  the  SAFE 
Port  Act  requirement  to  complete  validations  not  later  than  1  year  after 
certification,  to  the  extent  practicable.  During  the  validation  process,  CBP 
security  specialists  meet  with  company  representatives  to  verify  that  the 
supply  chain  security  measures  contained  in  the  company’s  security 
profile  are  in  place  as  described  in  the  profile.  If  the  company  is  an 
importer  operating  an  international  supply  chain,  the  security  specialists 
are  to  visit  the  company’s  domestic  and  foreign  sites.11  The  CBP  security 


11  One  country,  China,  denies  CBP  personnel  access  to  conduct  supply  chain  security 
validations.  For  more  information  on  CBP  efforts  to  conduct  validations  in  China,  see 
app.  II. 
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specialist  assigned  to  a  company  identifies  potential  sites  to  visit  based  on 
research  of  the  company’s  business  history,  import  transportation  modes, 
facility  locations,  and  other  factors.  Preliminary  selections  are  discussed 
with  company  officials  and  the  C-TPAT  program  director  provides  final 
approval.  To  initiate  the  validation,  the  security  specialist  provides  the 
member  an  outline  of  the  discussion  areas  for  meetings  and  site  visits  and 
a  site  visit  agenda.  Upon  completion  of  the  validation  process,  CBP 
prepares  a  final  validation  report  it  presents  to  the  company.  The  report 
may  include  recommendations  to  improve  security  and  required  actions,  if 
any,  the  member  must  take  to  conform  to  minimum  security  requirements, 
as  well  as  a  determination  on  whether  the  member  should  continue  to 
receive  program  benefits  and,  if  an  importer,  whether  additional  program 
benefits  are  warranted.  The  SAFE  Port  Act  refers  to  validated  members  as 
Tier  2  participants  and  provides  that  CBP  is  to  extend  benefits  to  them, 
which  may  include  reduced  examinations  of  cargo,  among  other  benefits. 

Once  a  C-TPAT  member  completes  the  validation  process,  CBP  requires 
the  member  to  perform  an  annual  self-assessment — essentially  an  update 
of  its  security  profile — that  provides  the  member  with  an  opportunity  to 
review,  update,  or  change  its  security  procedures  as  needed.  CBP  requires 
its  security  specialists  to  annually  certify  that  members  complete  the  self- 
assessment,  but  does  not  subject  each  annual  self-assessment  to  its 
validation  process.  Rather,  CBP  plans  to  revalidate  members’  security 
once  every  3  years,  as  stated  in  the  House  Appropriations  Committee 
report  accompanying  the  fiscal  year  2007  DHS  appropriations  bill.13  CBP 
began  revalidations  in  early  2007 — about  3  years  from  the  time  the  first 
C-TPAT  members  had  been  initially  validated.  As  part  of  an  overall 
revalidation  strategy,  CBP  first  performed  annual  revalidations  of 
U.S./Mexico  long  haul  highway  carriers  because  of  the  high  risk  for  drug 
trafficking  and  also  conducted  special  revalidations  for  members  involved 
in  a  serious  violation,  such  as  a  drug  seizure. 


13  The  SAFE  Port  Act  required  CBP  to  conduct  revalidations  at  least  once  every  4  years,  but 
CBP  has  elected  to  perform  them  every  3  years  in  response  to  the  committee  report 
language. 
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SAFE  Port  Act  and 
International  Initiatives 
that  Affect  the  C-TPAT 
Program 


The  SAFE  Port  Act  provides  a  statutory  framework  for  the  C-TPAT 
program,  which  previously  had  been  an  agency  initiative  not  specifically 
required  by  law.  The  act  formally  established  the  program’s  structure, 
including  eligible  participants,  basic  requirements,  benefits,  and  operating 
processes.  Moreover,  the  act  mandated  that  the  program  have  sufficient 
internal  controls14  to  support  C-TPAT  management  systems  and  include 
such  elements  as  a  strategic  plan  to  identify  outcome-based  goals  and 
performance  measures;  an  annual  plan  to  match  available  resources  and 
projected  workload;  a  standardized  work  program  to  execute  its 
processes;  and  a  record  management  system  to  document  processing 
determinations . 15 

In  recent  years,  CBP’s  international  efforts  have  made  C-TPAT  a  focus  of 
other  countries  interested  in  developing  similar  customs-to-business 
partnership  programs  or  considering  arrangements  with  other  countries  to 
mutually  accept  the  results  of  programs  similar  to  C-TPAT.  Foreign 
officials  within  the  European  Union  and  elsewhere  have  closely  observed 
the  C-TPAT  program  as  one  potential  model  for  enhancing  supply  chain 
security.  As  we  have  previously  reported  and  CBP  has  recognized,  in 
security  matters  the  United  States  is  no  longer  self-contained,  either  in  its 
problems  or  its  solutions.16  The  growing  interdependence  of  nations 
requires  policymakers  to  recognize  the  need  to  work  in  partnerships 
across  boundaries  to  achieve  vital  national  goals.  For  this  reason,  CBP  has 
committed,  through  its  strategic  planning  process,  to  promote  an 
international  framework  of  standards  governing  customs  and  related 
business  relationships  in  order  to  enhance  supply  chain  security.  C-TPAT 
is  one  component  of  this  ongoing,  broad-based  effort.17 


14  Internal  controls  are  the  integral  components  of  an  organization’s  management  that 
provide  reasonable  assurance  of  the  effectiveness  and  efficiency  of  operations,  the 
reliability  of  financial  reporting,  and  the  compliance  with  applicable  laws  and  regulations. 

15  Outcome-based  goals  are  goals  that  reflect  the  intended  purpose  of  a  program  or  activity. 

16  See  GAO,  Maritime  Security:  The  SAFE  Port  Act:  Status  and  Implementation  One  Year 
Later,  GAO-08-126T  (Washington,  D.C.:  Oct.  30,  2007). 

17  GAO  has  work  ongoing  addressing  international  maritime  security  efforts  and  plans  to 
issue  a  report  in  the  spring  of  2008. 
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CBP  Has 

Strengthened  C-TPAT 
by  Establishing 
Minimum  Security 
Criteria  and  a  Tiered 
Approach  to 
Awarding  Benefits  to 
Importers 


Since  March  2005,  CBP  has  been  working  with  the  trade  community  to 
establish  revised  C-TPAT  minimum  security  criteria  for  specific  trade 
sectors  to  replace  the  more  general  security  guidelines  previously  in  effect 
for  C-TPAT  participation.  As  of  November  2007,  CBP  had  issued  the 
revised  criteria  for  9  of  the  10  trade  sectors  that  participate  in  C-TPAT: 
importers,  sea  carriers,  highway  carriers,  rail  carriers,  air  carriers,  foreign 
manufacturers,  U.S.  customs  brokers,  U.S.  and  foreign  maritime  port 
authorities  and  terminal  operators,  and  long  haul  highway  carriers  in 
Mexico.  The  agency  anticipates  finalizing  criteria  for  the  remaining  trade 
sector — freight  consolidators/ocean  transportation  intermediaries  and 
nonvessel-operating  common  carriers — and  making  it  effective  by  mid- 
2008.  According  to  CBP,  defining  the  makeup  of  this  sector  is  a  challenge 
because  of  the  variety  of  entities  that  may  serve  in  this  role. 

Overall,  these  criteria  provide  greater  specificity  about  what  is  expected  of 
the  C-TPAT  members.  For  example,  the  older,  general  guidance  to  foreign 
manufacturers  required  that  “Where  a  manufacturer  out  sources  or 
contracts  elements  of  its  supply  chain,  such  as  a  transportation, 
conveyance,  warehouse. .  .the  manufacturer  must  work  with  these 
business  partners  to  ensure  that  pertinent  security  measures  are  in  place 
and  adhered  to  throughout  their  supply  chain.”  The  minimum  security 
criteria  for  foreign  manufacturers  now  state  that  “Foreign  manufacturers 
must  have  written  and  verifiable  processes  for  the  selection  of  business 
partners  including,  carriers,  other  manufacturers,  product  suppliers....” 


CBP  Is  Completing  Its 
Establishment  of  Minimum 
Security  Criteria  for 
C-TPAT  Members 


In  March  2005,  we  reported  that  CBP  had  not  taken  a  rigorous  approach  to 
verifying  C-TPAT  members’  supply  chain  security,  thereby  limiting  its 
ability  to  ensure  that  the  program  helps  prevent  terrorism  and  that 
members  are  deserving  of  any  C-TPAT  benefits  received.18  Since  our 
report,  CBP  has  acted  on  our  recommendations  to  strengthen  the  security 
validation  process  by  establishing  minimum  security  criteria  for  the 
majority  of  C-TPAT  members  and  providing  a  tiered  structure  for 
awarding  benefits  to  importers.  CBP  also  has  actions  underway  to 
establish  minimum  security  criteria  for  its  remaining  members. 


18  GAO-05-404. 
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Table  2  lists  the  trade  sectors  for  which  CBP  has  issued  minimum  security 
criteria  and  provides  examples  of  the  criteria  established.  The  SAFE  Port 
Act  of  2006  ratified  this  approach,  requiring  that  companies  seeking  to 
participate  in  C-TPAT  maintain  security  measures  and  supply  chain 
security  practices  in  accordance  with  criteria  established  by  CBP. 


Table  2:  Examples  of  Minimum  Security  Criteria  That  Trade  Sectors  Must  Meet  for  C-TPAT  Participation 

Trade  sector 

Examples  of  minimum  security  criteria 

Month/year 
revised  minimum 
criteria  effective 

Importers 

Written  procedures  must  stipulate  how  seals  are  to  be  controlled  and 
affixed  to  loaded  containers. 

March  2005 

Sea  carriers 

A  vessel  visitor  log  must  be  maintained  and  a  temporary  visitor  pass 
must  be  issued. 

March  2006 

Highway  carriers 

Trailers  must  be  stored  in  a  secure  area  to  prevent  unauthorized  access 
and/or  manipulation. 

March  2006 

Foreign  manufacturers 

To  help  ensure  the  integrity  of  cargo,  procedures  must  be  in  place  to 
ensure  that  information  received  from  business  partners  is  reported 
accurately  and  timely. 

August  2006 

Rail  carriers 

Rail  carriers  must  have  procedures  in  place  for  reporting  unauthorized 
entry  into  rail  cars  and  locomotives. 

August  2006 

U.S.  customs  brokers 

For  all  brokers,  procedures  for  the  issuance,  removal,  and  changing  of 
access  devices  (e.g.,  keys,  key  cards,  etc.)  must  be  documented. 

January  2007 

U.S.  and  foreign  marine  port 
authorities  and  terminal  operators 

An  employee  identification  system  must  be  in  place  for  positive 
identification  and  access  control  purposes. 

August  2007 

Long  haul  highway  carriers  in 
Mexico 

Written  procedures  must  exist  which  identify  specific  factors  or  practices, 
that  may  deem  a  shipment  from  a  certain  shipper  of  greater  risk. 

August  2007 

Air  carriers 

Procedures  must  be  in  place  to  prevent,  detect,  or  deter  unmanifested 
material  and  unauthorized  personnel  from  gaining  access  to  aircraft, 
including  concealment  in  cargo. 

November  2007 

Source:  CBP. 


Note:  CBP  has  not  issued  minimum  security  criteria  for  one  trade  sector — freight  consolidators/ocean 
transportation  intermediaries  and  nonvessel  operating  common  carriers.  CBP  projects  that  criteria  will 
be  issued  and  effective  for  the  trade  group  by  mid-2008. 


CBP  Has  Established 
Tiered  Benefits  for 
Importers 


As  another  step  to  strengthen  C-TPAT  policies,  CBP  introduced  a  “tiered” 
benefits  process  for  importers,  whereby  benefits  are  awarded  on  a  tiered 
basis  depending,  in  part,  on  CBP’s  validation  to  verify  the  importer’s 
supply  chain  security  plans  and  the  extent  to  which  importers 
demonstrated  a  sustained  commitment  to  implementing  minimum  supply 
chain  security  practices.  This  tiered  approach,  which  is  now  codified  in 
the  SAFE  Port  Act,  addresses  a  problem  we  identified  in  our  March  2005 
report,  namely,  that  CBP  granted  companies  full  C-TPAT  benefits  before 
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verifying  C-TPAT  members’  security  procedures.19  At  that  l  ime,  we 
reported  that  CBP’s  screening  process  for  certifying  and  assessing 
member  companies  provided  no  actual  verification  that  the  security 
measures  in  the  company’s  reported  security  profile  were  accurate  and 
being  followed  before  granting  benefits.  Under  the  new  tiered  approach, 
CBP  postpones  the  granting  of  broader  benefits  for  individual  importers — 
who  make  up  48  percent  of  C-TPAT  members — until  after  it  conducts  a 
validation  to  verify  the  individual  importer’s  supply  chain  security 
practices. 

While  importers  receive  tiered  benefits,  other  C-TPAT  trade  sectors — 
which  include  sea  carriers,  highway  carriers,  U.S.  marine  and  port 
terminal  operators,  foreign  manufacturers,  consolidators,  and  U.S. 
customs  brokers  and  account  for  about  52  percent  of  C-TPAT  members — 
receive  all  benefits  available  to  them,  such  as  access  to  other  C-TPAT 
members  and  attendance  at  CBP-sponsored  security  training,  upon  being 
certified  into  the  program  and  before  their  security  plans  are  verified.  CBP 
considered  the  practicality  and  relevancy  of  implementing  tiered  benefits 
for  the  nonimporter  trade  sectors  as  well  as  importers,  but  CBP  officials 
said  they  are  having  difficulty  identifying  additional  benefits  available  to 
offer  nonimporters  in  a  tiered  benefit  structure.  Specifically,  CBP  officials 
said  that  C-TPAT  participants  in  these  sectors  generally  derive  their 
benefits  from  the  business  world  in  the  form  of  increased  marketability 
once  they  are  designated  a  C-TPAT  member.  Hence  CBP  would  have  no 
additional  benefits  to  offer  these  participants.20 

While  the  SAFE  Port  Act  provides  for  three  tiers  of  participation  and 
benefits  for  C-TPAT  members,  CBP  officials  told  us  that  they  interpret  the 
benefit  tiering  provisions  of  the  act  to  apply  mainly  to  importers  who  use 
their  international  supply  chains,  consisting  of  the  other  trade  sectors,  to 
bring  goods  into  the  United  States.  Thus,  although  CBP  acknowledges  the 
act’s  tiered  benefit  structure,  it  believes  the  structure  does  not  necessarily 
apply  to  all  participants. 


19  GAO-05-404. 

20  Highway  carriers  and  manufacturers  who  participate  in  CBP’s  Free  and  Secure  Trade 
(FAST)  initiative  are  the  exception.  The  initiative  is  between  the  United  States,  Canada, 
and  Mexico  and  allows  known  low-risk  highway  carriers  and  manufacturers  that  are  C- 
TPAT  certified  to  receive  expedited  border  processing. 
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When  the  SAFE  Port  Act  established  the  statutory  framework  for  the 
C-TPAT  program,  it  set  forth  tiered  benefits  for  all  C-TPAT  members,  but 
provided  examples  of  tiered  benefits  that  apply  only  to  importers. 
Specifically,  as  shown  in  table  3,  the  act  established  three  tiers  for  granting 
C-TPAT  members  benefits  and  gave  examples  that  describe  the  reduced 
likelihood  of  scrutiny  or  expedited  processing  of  an  importer’s 
containerized  cargo. 


Table  3:  Summary  of  C-TPAT  Tiered  Benefits  Structure  from  the  SAFE  Port  Act 

C-TPAT 
benefit  level 

When 

benefits  are  awarded 

Time  frame 

for  benefits  determination 

Benefit  examples 

Tier  1 

Upon  CBP’s  certification  of 
applicant  as  a  C-TPAT 
member 

Within  90  days  of  CBP’s  receipt 
of  an  application  for  C-TPAT 
membership,  to  the  extent 
practicable 

May  include: 

•  a  maximum  20  percent  reduction  in  Automated 
Targeting  System  score  for  an  importer 

Tier  2 

Upon  validation  of  member’s 
security  measures  and 
supply  chain  security 
practices 

Within  1  year  of  a  member’s 
certification  into  C-TPAT,  to  the 
extent  practicable 

May  include: 

•  reduced  scores  in  Automated  Targeting  System 
for  importers 

•  reduced  cargo  examinations3 

•  priority  cargo  searches11 

Tier  3 

Upon  validation  that  member 
demonstrates  sustained 
commitment  to  maintaining 
measures  and  practices  that 
exceed  Tier  2  guidelines 

No  time  frame  specified,  but  may 
be  done  as  part  of  Tier  2 
validation 

May  include: 

•  expedited  release  of  cargo  in  U.S.  ports  at  all 
threat  levels  designated  by  the  Secretary, 
Homeland  Security 

•  further  reduction  in  cargo  examinations 

•  priority  cargo  examinations 

•  further  reduction  in  the  Automated  Targeting 
System  risk  score  for  importers 

•  inclusion  in  joint  incident  management 
exercises,  as  appropriate 


Source:  GAO. 

“An  examination  is  an  inspection  of  cargo  to  detect  the  presence  of  misdeclared,  restricted,  or 
prohibited  items  that  utilizes  nonintrusive  imaging  such  as  x-ray  and  detection  technology. 

bA  search  is  an  intrusive  examination  in  which  a  container  is  opened  and  its  contents  are  unloaded 
and  visually  inspected  for  the  presence  of  misdeclared,  restricted,  or  prohibited  items. 


Tier  1  benefits  are  to  be  limited  and  may  include  a  reduction  in  the  score 
assigned  a  shipment  through  CBP’s  Automated  Targeting  System  of  not 
greater  than  20  percent  of  the  high-risk  threshold  established  by  the 
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Secretary  of  Homeland  Security.21  CBP  is  to  determine,  by  comparing  the 
applicant’s  security  profile  to  established  minimum  security  criteria  or 
guidelines,  whether  a  C-TPAT  applicant  is  to  be  certified  and  granted 
benefits  within  90  days  of  receiving  the  application,  to  the  extent 
practicable.  CBP  must  also  vet  the  C-TPAT  applicant  by  reviewing  the 
applicant’s  compliance  with  customs  laws  and  regulations  and  any 
violation  history.  If  CBP  gives  the  applicant  a  favorable  review,  the 
applicant  is  certified  as  a  C-TPAT  member  and  limited  benefits  can  begin. 

Tier  2  or  3  benefits  are  to  be  determined  based  on  CBP’s  validation  results. 
After  certifying  a  member  into  C-TPAT  and  granting  limited  Tier  1  benefits, 
CBP  is  to  conduct  the  validation  process  to  verify  the  member’s  security 
measures  and  practices.  The  SAFE  Port  Act  provides  that  all  C-TPAT 
participants  undergo  validation,  including  on-site  assessments,  within  1 
year  of  certification  as  a  Tier  1  participant,  to  the  extent  practicable.  CBP 
is  to  extend  benefits  to  each  validated  Tier  2  participant,  which  may 
include,  in  contrast  to  limited  Tier  1  benefits,  further  reductions  in 
Automated  Targeting  System  scores,  reduced  examinations  of  cargo,  and 
priority  searches  of  cargo.  The  act  also  provides  for  validation  of  C-TPAT 
members  as  Tier  3  participants  if  they  demonstrate  a  sustained 
commitment  to  maintaining  security  measures  and  supply  chain  security 
practices  that  exceed  Tier  2  guidelines,  but  there  is  no  deadline  for  making 
this  determination.  Upon  Tier  3  validation,  participants  are  to  receive  Tier 
3  benefits,  which  may  include  further  reductions  in  Automated  Targeting 
System  scores  or  cargo  examinations,  among  other  benefits.  See  appendix 
IV  for  data  on  C-TPAT  members  who  have  received  tiered  benefits  through 
December  2007. 


21  As  discussed  earlier  in  this  report,  the  Automated  Targeting  System  is  a  computerized 
targeting  model  that  CBP  uses  in  the  targeting  and  inspection  of  cargo  that  arrives  at  U.S. 
ports.  ATS  uses  hundreds  of  targeting  rules  to  check  available  data  on  every  arriving 
container  and  assigns  each  container  a  risk  characterization  or  score. 
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CBP  Has  Taken  Steps 
to  Improve  Data 
Collected  for 
Validation,  but  Still 
Faces  Limitations  to 
Assure  Consistent 
Program  Decisions 
and  Effective  Security 


The  SAFE  Port  Act  mandated  that  the  C-TPAT  program  have  sufficient 
internal  controls  to  support  C-TPAT  management,  including  a 
standardized  work  program  for  validations.  Standards  for  internal  control 
in  the  federal  government  call  for  policies  and  procedures  to  ensure  that 
the  findings  from  audits  and  other  reviews  are  promptly  resolved.  While 
CBP  developed  a  personal-computer-based  (PC-based)  electronic 
instrument  to  help  security  specialists  ensure  that  validation  information 
is  consistently  collected,  documented,  and  uniformly  applied  to  decisions 
regarding  the  awarding  of  benefits  to  C-TPAT  members,  design  problems 
with  the  instrument  limit  its  effectiveness.  Also,  while  the  validation 
instrument  allows  specialists  an  opportunity  to  collect  data  on  the  results 
of  members’  internal  or  third-party  audits  and  inspections  of  their  supply 
chain  security  practices,  CBP  does  not  require  security  specialists  to  use 
these  data  in  validating  members’  security  practices  as  an  alternative  to 
direct  testing,  even  though  CBP  views  direct  testing  as  impractical. 
Further,  our  work  shows  that  CBP  lacks  a  systematic  process  to  ensure 
appropriate  actions  are  taken  in  response  to  security  specialists’ 
recommendations  in  validation  reports.  Without  such  a  key  internal 
control,  CBP  does  not  have  reasonable  assurance  that  companies 
implement  its  recommendations  to  enhance  supply  chain  security 
practices  in  accordance  with  CBP  criteria. 


CBP  Has  Developed  an  In  addition  to  its  efforts  to  enhance  the  C-TPAT  program’s  policies  with 

Instrument  to  Collect  minimum  security  criteria  and  tiered  benefits,  CBP  has  developed  a 

Validation  Data  portable,  PC-based  electronic  instrument  to  help  improve  its  process  for 

collecting  information  during  the  validation  process.  In  March  2005,  we 
recommended  that  CBP  strengthen  the  validation  process  by  providing 
appropriate  guidance  to  security  specialists  conducting  validations.  CBP, 
partly  in  response  to  our  recommendation,  developed  and  implemented 
the  Validation  Security  Assessment  Tool  (VSAT)  to  guide  security 
specialists  in  performing  validations,  including  data  gathering  and 
documentation.22  Prior  to  implementation  of  the  VSAT  in  March  2006, 
C-TPAT  did  not  have  a  consistent  way  to  collect  validation  information. 


“2  In  December  2004,  C-TPAT  management  issued  requirements  for  an  automated  risk 
assessment  and  validation  tool  to  the  contractor  in  CBP’s  Automated  Commercial 
Environment  project — a  multiyear  effort  to  modernize  CBP’s  business  processes, 
information  technology,  and  infrastructure.  The  VSAT  is  a  result  of  the  contractor’s  effort. 
Per  CBP’s  requirement’s  statement,  the  initial  purpose  of  the  tool  was  to  provide  C-TPAT 
validation  capability,  but  information  gathered  using  the  tool  would  ultimately  serve  as 
input  to  CBP’s  Automated  Targeting  System,  used  in  selecting  containerized  shipments  for 
inspection. 
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Rather,  it  was  up  to  individual  security  specialists  to  determine  how  to 
verify  supply  chain  security.  With  VSAT,  security  specialists  are  provided 
an  electronic,  PC-based  instrument  that  contains  a  series  of  uniform 
questions  within  seven  defined  security  areas  that  can  be  asked  of  C-TPAT 
member  companies  and  their  foreign  supply  chain  partners  during  the 
validation  process.  Figure  4  provides  an  overview  of  the  validation  process 
and  describes  how  security  specialists  are  to  use  the  VSAT  in  conducting 
validations. 
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Figure  4:  C-TPAT  Validation  Overview — Key  Processing  Steps  Used  by  Supply  Chain  Security  Specialists  (SCSS) 


1  Verify  eligibility 
for  validation 

•  Verify: 

-  completion  of  vetting 

-  company  profile 
information  is  complete 

-  benefits  status 

-  company  status  as 
"Certified" 

•  Ensure: 

-  30-day  notice  of  validation 
sent  to  company 

-  all  minimum  security  criteria 
have  been  met  per  security 
profile;  security  profile  is 
approved 


2  Research  and  plan 

•  Use  open  source  data 
to  determine  company’s 
size,  legal  business 
designation,  facility 
locations,  business  and 
import  history,  import 
transportation  modes, 
membership  in  other 
CBP  programs 

Identify  potential  visit 
sites,  options  to  coordinate 
with  other  validations  and 
CBP  validation  partner 
(e.g.,  field  SCSS) 


3  Contact  company  and 
schedule  validation 

•  Establish  communication 
with  partner  point  of 
contact 

-  discuss  validation  process 

-  provide  outline  of  discussion 
areas  for  meeting(s)  and 
site  visits 

-  discuss  visit  sites/agenda 

-  advise  of  documentation 
needed 

-  determine  legal/financial 
responsibility  for  cargo 
and  who  controls  cargo 
within  the  supply  chain 


4  Preparation  and 
local/HQ  approval 

•  Input  research  data  into 

Validation  Security  Assessment 
Tool  (VSAT) 

•  Identify  type(s)  of  implementation 
evidence  to  be  verified  during 
visit/meeting 

•  Prepare/submit  validation 
preparation  outline  for 
management  approval 

•  Field  Office  Director/ 

Supervisory  SCSS  reviews 
outline/submits  to  C-TPAT 
Program  Director 

•  Program  Director  reviews/ 
approves  Validation 
Preparation  Outline 


5 


Conduct  onsite 
validation 


6  Close-out  and  determine 
C-TPAT  status 


7 


•  Lasts  4  to12  hours 

•  SCSS  discusses  validation 
process 

•  Company  explains  its 
risk  analysis  and 
security  practices 

•  SCSS  asks  clarifying 
questions,  follows  up 
on  security  profile  and 
gathers  data  on  security 
vulnerabilities,  gaps 
and  risks 

-  SCSS  may  ask  questions 
directly  from  VSAT  or  use 
VSAT  to  outline  questions 
before  meeting 


Conduct  close-out  meeting 
at  or  after  final  site  visit 

-  inform  C-TPAT  partner  of 
validation  results 

-  make  it  clear  that  final 
status  is  determined  by  the 
C-TPAT  Program  Director 
based  on  the  validation  findings 

Analyze  findings  and 
recommend  program  status 
for  company 


•  SCSS  verifies/reviews  evidence 
of  security;  tours  facility 


Perform  administrative 

tasks  and  develop 

validation  report 

•  Upload  VSAT  data  to  portal 
within  7  days  of  foreign  visit 

•  Immediately  ask  supervisor  to 
upgrade  benefits  for  eligible 
importers/change  partner 
status  to  “validated” 

•  Notify  supervisor  immediately  of 
companies  recommended  for 
suspension  or  removal 

•  Forward  final  report  to  field  office 
director  for  approval 

-  SCSS  relies  mainly  on  personal 
notes  and  recollections 

•  Forward  reports  recommending 
Tier  3  benefits  to  Director/ 
C-TPAT  Industry  Partnerships; 
final  authority  rests  with 
Executive  Director,  Cargo  & 
Conveyance  Security 


Conduct  follow-up/ 
self-assessment/ 
new  validation 

•  For  validated  companies 
meeting  or  exceeding  criteria: 

-  track  progress  of  corrective 
actions  in  an  action  plan 

-  communicate  regularly  with 
partner;  check  to  see  if 
partner  has  improved  security 

-  ensure  partner  conducts  an 
annual  self-assessment 

•  For  companies  receiving  a 
negative  validation  finding: 

-  provide  guidance  to 
restore  benefits 

-  track  company's  progress  and 
verify  information  provided 

-  conduct  a  new  validation 


•  Send  letter  and  final  report  to  partner 


Source:  GAO  and  CBP. 


According  to  CBP,  the  VSAT  was  developed  to  help  security  specialists 
collect  validation  information  in  a  consistent  and  uniform  way  and  to 
measure  the  C-TPAT  members’  security  from  the  foreign  point  where 
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cargo  is  loaded  into  the  container  to  the  port  where  the  container  is  loaded 
onto  a  vessel.  The  development  of  an  instrument  such  as  VSAT  also  helps 
CBP  carry  out  the  SAFE  Port  Act  requirement  that  C-TPAT  establish 
internal  controls  to  help  ensure  that  a  standardized  work  program  is  used 
to  execute  validations  and  other  C-TPAT  management  processes.  Further, 
according  to  the  VSAT  requirements  statement  that  initiated  its 
development,  CBP  planned  to  eventually  use  the  VSAT  data,  as  they  relate 
to  C-TPAT  member  benefits,  for  direct  input  to  its  Automated  Targeting 
System  for  identifying  containerized  shipments  for  inspection  based  on 
risk. 


CBP’s  VSAT  Design  Limits 
Its  Usefulness  for 
Providing  a  Standardized 
Validation  Process 


The  VSAT,  as  envisioned  by  CBP,  has  the  potential  to  strengthen  C-TPAT 
processes.  CBP  officials  see  the  VSAT  as  a  way  of  addressing  our  earlier 
concerns  with  the  adequacy  and  consistency  of  validations,  as  discussed  in 
our  March  2005  C-TPAT  report.23  However,  CBP’s  use  of  the  VSAT  to 
ensure  that  validation  information  is  consistently  collected,  documented, 
and  uniformly  applied  is  limited. 


CBP’s  design  of  the  VSAT  does  not  provide  for  reliable  analysis  of  data 
regarding  verification  of  C-TPAT  members’  security  practices.  Specifically, 
the  VSAT  uses  a  binary  format  that  requires  security  specialists  to  answer 
questions  in  a  “yes/no”  format  with  “no”  being  the  default  response.  With 
this  format,  one  cannot  determine  whether  a  “no”  response  denotes  an 
intentional  “no,”  “not  applicable,”  or  that  the  security  specialist  simply 
skipped  or  failed  to  complete  the  item.  Determining  the  meaning  of  a  “no” 
response  is  especially  challenging  considering  that  the  VSAT  consists  of 
three  electronic  questionnaires  that  include  a  list  of  validation  steps  and 
questions  that  range  from  about  250  to  more  than  900  lines.  Security 
specialists  select  the  appropriate  questionnaire  to  use  in  a  validation  and, 
even  when  the  shortest  questionnaire  applies,  the  number  of  validation 
steps  and  questions  posed  is  extensive.  Further,  the  security  specialists 
use  their  discretion  to  answer  or  not  answer  individual  questions  based  on 
their  assessment  of  the  relevance  of  those  questions  to  the  companies’ 
security  practices.  The  reason  for  a  “no”  response  is  not  accurately 
recorded  unless  the  security  specialist  provides  an  explanatory  note. 

While  a  “yes”  response  should  mean  that  a  security  practice  is  in  place  or 
effective,  overall  analysis  of  VSAT  data  is  not  possible  because  of  the 
uncertainty  associated  with  the  “no”  responses.  Consequently,  the 


23  See  GAO-05-404. 
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accuracy  and  reliability  of  the  data  associated  with  CBP’s  validation  of 
C-TPAT  members’  security  practices  are  unknown. 


CBP’s  Security  Specialists 
Validate  C-TPAT  Members’ 
Security  Practices  Based 
on  Information  Other  than 
Testing  Results 


CBP  accepts  a  company  as  a  C-TPAT  member  and  initiates  benefits  based 
on  a  CBP  security  specialist’s  favorable  review  of  the  security  profile 
submitted  by  the  company.  The  security  specialist  verifies  only  that  the 
self-reported  information  meets  C-TPAT’s  minimum  security  criteria. 
During  the  validation  process,  CBP  security  specialists  gather  information 
on  security  vulnerabilities,  gaps,  and  risks  through  activities  that  include 
(1)  asking  questions  about  the  company’s  security  practices,  (2)  gathering 
information  by  observing  physical  security  and  reviewing  policies  and 
procedures,  (3)  identifying  accountability  for  security,  and  (4)  identifying 
any  requirements  the  member  may  have  for  audits  (or  testing  to  be 
conducted)  of  its  security  measures  to  determine  if  the  measures  are 
working  as  intended.  However,  because  of  the  voluntary  nature  of  the 
C-TPAT  program,  limited  resources,  and  limits  to  CBP’s  jurisdiction  over 
international  trade  partners,  it  is  impractical  for  CBP  to  directly  test 
members’  supply  chain  security  practices.  Without  such  testing,  CBP  is 
challenged  to  know  that  members’  security  measures  are  reliable, 
accurate,  and  effective — the  stated  purpose  of  the  validation  process. 


In  addition  to  information  CBP  collects  during  the  validation  process, 
C-TPAT  companies  may  perform  ongoing  monitoring  of  their  supply  chain 
security  in  the  course  of  normal  operations.  The  VSAT  includes  a  variety 
of  questions  regarding  member  companies’  actions  to  monitor  security, 
including  whether  a  company:  (1)  periodically  inspects  its  security 
measures  and  documents  the  results,  (2)  has  documented  procedures  to 
review  the  effectiveness  of  security,  (3)  performs  security  audits,  or  (4) 
monitors  the  security  practices  of  contractors.  Specialists  are  not  required 
to  use  this  information  in  making  security  assessments  and,  according  to 
the  11  specialists  that  we  interviewed,  are  not  doing  so.  However,  without 
using  such  information,  CBP  lacks  assurance  that  C-TPAT  is  meeting  its 
goal  to  enhance  supply  chain  security. 
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Consistent  with  Operating 
Procedures,  CBP  May 
Grant  C-TPAT  Benefits 
Before  Members 
Implement  Recommended 
Security  Enhancements 
and  Does  Not 
Systematically  Follow  Up 
on  Actions  Taken 


We  examined  three  validation  reports  and  their  transmittal  letters 
provided  by  CBP’s  Executive  Director,  Cargo  and  Conveyance  Security,  as 
typical  examples.  Two  of  the  letters  advised  the  C-TPAT  member  of  Tier  2 
or  Tier  3  eligibility,  but  also  noted  required  actions  to  enhance  security 
such  as  (1)  having  documentation  that  business  partners  are  meeting 
C-TPAT  security  criteria  or  (2)  having  a  system  in  place  to  identify  abuse 
of  the  company’s  information  technology  system.  Because  the  validation 
data  provided  by  CBP  did  not  include  all  items  needed  to  analyze  C-TPAT 
member  processing,  such  as  the  date  a  company  was  selected  for  a 
security  validation,  we  could  not  determine  how  often  these  situations 
have  occurred  or  whether  Tier  2  or  Tier  3  benefits  had  been  provided  to 
members  who  had  not  yet  implemented  required  actions  to  meet  C-TPAT 
minimum  security  requirements.  However,  CBP’s  lack  of  systematic 
procedures  to  follow  up  and  verify  that  validation  recommendations  are 
implemented  is  inconsistent  with  CBP’s  validation  purpose  to  ensure  that 
members’  security  practices  meet  or  exceed  C-TPAT  minimum  security 
criteria. 

Besides  granting  benefits  before  ensuring  recommended  actions  are 
implemented,  CBP’s  policy  does  not  require  its  security  specialists  to 
systematically  follow  up  to  ensure  that  companies  implement  validation 
report  recommendations  to  make  their  security  practices  consistent  with 
minimum  security  criteria.  Instead,  security  specialists  are  encouraged,  for 
example,  to  track  the  progress  of  corrective  actions  a  member  is  required 
to  take,  communicate  regularly  with  the  member,  and  check  back 
occasionally  to  see  if  the  member’s  security  has  changed  or  improved. 


The  SAFE  Port  Act  mandated  that  the  C-TPAT  program  have  sufficient 
internal  controls  to  support  C-TPAT  management  systems,  including  a 
standardized  work  program  to  execute  validation  and  other  program 
processes.  Once  validation  data  collection  is  completed,  the  security 
specialist  is  to  analyze  the  validation  findings  and  formulate  a 
recommendation  on  the  C-TPAT  program  status  for  the  company. 
However,  at  the  conclusion  of  a  validation  site  visit,  CBP  may  award  a 
company  benefits  before  recommended  actions  to  enhance  security  are 
implemented.  This  practice  is  within  the  scope  of  CBP’s  operating 
procedures  for  C-TPAT.  The  transmittal  letter  for  the  subsequently 
prepared  validation  report  is  to  inform  the  importer  of  its  eligibility  for  the 
new  benefits  status,  even  if  the  validation  report  includes  required  actions 
to  meet  minimum  security  requirements.  The  letter  encourages  the 
importer  to  comment  on  its  plans  to  adopt  the  validation  report’s 
recommendations;  however,  the  eligibility  for  benefits  is  not  stated  as 
being  contingent  upon  the  importer  implementing  the  required  actions. 
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Security  specialists  are  also  to  ensure  that  C-TPAT  members  conduct  an 
annual  self-assessment  and  update  their  security  profiles,  but  are  not 
required  to  verify  these  profile  changes.  Further,  when  planning 
revalidations,  security  specialists  are  to  consider  sites  visited  during  the 
previous  validation  that  were  the  source  of  recommendations  or  required 
actions.  However,  the  security  specialists  are  not  required  to  visit  problem 
areas.  Without  requiring  its  security  specialists  to  verify  and  document 
that  C-TPAT  members  implement  validation  recommendations,  CBP  does 
not  have  sufficient  internal  controls  to  ensure  member  security  consistent 
with  minimum  security  criteria.  Specifically,  standards  for  internal  control 
in  the  federal  government  call  for  policies  and  procedures  to  ensure  that 
the  findings  audits  and  other  reviews  are  promptly  resolved.  We  addressed 
this  issue  with  CBP  officials.  CBP’s  Executive  Director,  Cargo  and 
Conveyance  Security,  agreed  that  CBP  could  do  more  to  follow  up  on 
validation  recommendations,  but  noted  that  security  specialists  use  their 
discretion  and  take  into  account  the  severity  of  the  security  shortfall  when 
making  validation  decisions. 


CBP  Has  Improved 
C-TPAT  Management 
with  Better  Human 
Capital  Planning  and 
Record  Keeping,  but 
Establishing  C-TPAT 
Program  Performance 
Measures  for  Security 
Enhancement 
Remains  a  Challenge 


Since  our  March  2005  report,  CBP  has  implemented  human  capital 
planning,  a  records  management  system,  and  performance  measures  to 
strengthen  C-TPAT  program  management  in  response  to  prior 
recommendations.24  In  particular,  CBP  developed  a  human  capital  plan 
that  addressed  long-term  staffing  needs  and  described  how  the  program 
will  recruit,  train,  and  retain  staff  to  achieve  program  goals.  CBP  also 
implemented  a  records  management  system  for  documenting  key  program 
decisions,  but  the  system  does  not  include  key  dates  to  monitor  C-TPAT 
processes.  Further,  CBP  increased  the  number  of  performance  measures 
for  some  aspects  of  the  C-TPAT  program,  but  CBP  does  not  yet  have 
performance  measures  to  determine  whether  the  program  meets  its 
security  goals.  While  these  efforts  have  helped  to  improve  C-TPAT 
management,  the  challenges  that  remain  limit  CBP’s  ability  to  monitor 
C-TPAT  program  operations  and  to  ensure  that  the  program  enhances  the 
supply  chain  security  of  C-TPAT  members. 


24  See  GAO-05-404. 
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CBP  Has  Developed  a 
Human  Capital  Plan  and 
Has  Increased  the  Number 
of  Supply  Chain  Security 
Specialists  to  Address  C- 
TPAT  Staffing  Challenges 


In  2005,  CBP  implemented  a  C-TPAT  human  capital  plan  to  systematically 
address  long-term  staffing  needs.  In  our  July  2003  and  March  2005  reports, 
we  noted  CBP’s  lack  of  a  systematic  plan  to  address  the  long-term  staffing 
resources  necessary  to  conduct  C-TPAT  program  activities  such  as 
conducting  validations,  reviewing  company  security  profiles,  and  vetting 
company  histories.25  In  addition  to  the  human  capital  plan,  CBP  developed 
a  formula  for  determining  the  number  of  validations  that  a  security 
specialist  can  complete  within  1  year,  which  it  used  for  its  workforce 
planning.  Since  implementation  of  the  plan,  CBP  increased  the  C-TPAT 
staff  by  280  percent — from  41  specialists  in  2005  to  a  total  of  156 
specialists  as  of  September  2007.  CBP  officials  reported  that  the  increase 
in  staff  will  allow  C-TPAT  to  continue  with  current  and  future 
certification,  validation,  and  revalidation  workloads  based  on  projected 
growth  in  program  membership.  Table  4  shows  CBP’s  projected  staffing 
and  validation  workload  for  2007  through  2009. 26 


Table  4:  CBP’s  Projected  C-TPAT  Staffing  and  Validation  Workload  for  2007-2009 

Year 

Supply 
chain  security 
specialist  staff 

Validations  per 
staff  per  year 

Total 
validations 
based  on 
staffing 

Initial 

validations  Revalidations 

Annual 
validations 
for  Mexican 
highway  carriers 

Total 
validations 
based  on 
workload 

2007 

150 

20 

3,000 

2,200 

420 

286 

2,906 

2008 

150 

20 

3,000 

1,500 

1,080 

400 

2,980 

2009 

200a 

20 

4,000 

1,500 

2,400 

400 

4,300 

Source:  GAO  analysis  of  data  provided  by  CBP. 


“Expected  total  staff  includes  an  additional  50  specialists  authorized  by  the  SAFE  Port  Act. 


The  human  capital  plan  also  describes  how  the  program  will  recruit,  train, 
and  retain  staff  to  achieve  program  goals.  CBP  has  expanded  the 
program’s  recruitment  process  to  target  candidates  with  experience  in 
intelligence  and  investigations  since  specialists  hired  in  2003  and  2004 
possess  previous  experience  in  supply  chain  security.  New  employees 


25  See  GAO-03-770  and  GAO-05-404. 

26  The  information  on  projected  staffing  and  validation  workload  in  this  report  is  based 
mainly  on  interviews  with  CBP  officials.  To  the  extent  possible,  we  corroborated  the 
information  provided  by  CBP  officials  with  agency  documentation.  Although  CBP  officials 
presented  the  data  as  their  official  numbers,  we  cannot  attest  to  their  reliability.  However, 
in  the  context  in  which  the  data  were  presented,  we  determined  the  usage  to  be 
appropriate  because  the  data  did  not  constitute  the  sole  support  of  our  findings, 
conclusions,  and  recommendations. 
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undergo  a  2-week  initial  training  program  and  also  have  opportunities  for 
recurring  training.  In  2007,  CBP  issued  an  annual  plan  update  for  the 
C-TPAT  program  to  address  SAFE  Port  Act  requirements.  The  act  requires, 
among  other  things,  that  CBP  (1)  review  all  new  applications  for 
certification  within  90  days,  to  the  extent  practicable;  (2)  conduct  initial 
validation  of  all  new  certified  members  within  1  year  of  acceptance  into 
the  program,  to  the  extent  practicable;  and  (3)  conduct  revalidation  of  all 
members  within  4  years  of  initial  validation.  CBP,  however,  plans  to 
conduct  revalidations  every  3  years.  The  SAFE  Port  Act  also  authorized  an 
additional  50  specialists  for  CBP  to  meet  additional  workload 
requirements  mandated  by  the  SAFE  Port  Act.  According  to  CBP  officials, 
the  agency’s  human  capital  plan  and  current  program  staffing  level  are 
sufficient  to  meet  SAFE  Port  Act  requirements  for  projected  validation  and 
revalidations  for  2007  and  2008.  CBP  anticipates  the  additional  50 
specialists  will  be  available  in  the  latter  part  of  2008  and  will  allow  C-TPAT 
to  meet  its  projected  workload  and  remain  compliant  with  SAFE  Port  Act 
requirements. 


CBP  Has  Implemented  a 
Records  Management 
System  for  Documenting 
Key  Program  Decisions, 
but  Certain  Key  Dates  Are 
Needed  to  Monitor  C-TPAT 
Processes 


In  our  March  2005  report,  we  recommended  that  CBP  implement  a  records 
management  system  that  accurately  documents  key  decisions  and 
significant  operational  events  in  a  timely  manner,  including  a  reliable 
system  for  documenting  and  maintaining  records  of  all  decisions  in  the 
C-TPAT  application  through  validation  processes.27  In  response  to  our 
recommendation,  CBP  has  developed  and  implemented  C-TPAT  Portal,  a 
centralized  electronic  records  management  system,  to  facilitate 
information  storage,  and  secure  interaction  and  communication  with 
C-TPAT  companies.  According  to  CBP  officials,  C-TPAT  Portal  is  the 
official  records  management  system  for  the  C-TPAT  program.  C-TPAT 
Portal  provides  real-time  access  to  C-TPAT  information,  tools,  and 
databases  for  C-TPAT  members  and  staff.  For  example,  the  system  enables 
CBP  to  track  and  ascertain  the  status  of  C-TPAT  applicants  and  member 
companies  to  ensure  that  they  are  certified,  validated,  and  revalidated 
within  time  frames  specified  in  the  SAFE  Port  Act. 


The  SAFE  Port  Act  requires  CBP  to  maintain  a  records  management 
system  to  document  determinations  on  the  reviews  of  each  C-TPAT 
member,  including  certifications,  validations,  and  revalidations.  Standards 
for  internal  control  in  the  federal  government  also  require  that  all 


27  See  GAO-05-404. 
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transactions  be  clearly  documented  in  a  manner  that  is  complete, 
accurate,  and  useful  to  managers  and  others  involved  in  evaluating 
operations.  Prior  to  implementing  C-TPAT  Portal  in  May  2006,  CBP  lacked 
a  basic  records  management  system  to  document  key  decisions  and  to 
regularly  and  accurately  update  programmatic  information.28  C-TPAT 
Portal  is  a  substantial  improvement  in  providing  a  framework  for 
capturing  data  on  C-TPAT  members  and  core  program  activities.  However, 
it  does  not  contain  certain  data,  including  important  processing  dates. 

During  our  review,  we  obtained  data  from  C-TPAT  Portal  on  a  sample  of 
419  validations  completed  during  March  through  September  2006.29  We 
attempted  to  analyze  CBP’s  time  frames  for  processing  the  companies — 
from  their  application  for  C-TPAT  membership  through  validation  of  their 
security  profiles  and  the  granting  of  C-TPAT  benefits — but  could  not 
complete  the  analysis  because  CBP  did  not  record  certain  key  data 
elements  in  C-TPAT  Portal.  Specifically,  based  on  our  review  of  the 
C-TPAT  membership  processes  and  the  data  items  in  C-TPAT  Portal,  we 
found  that  13  of  the  27  data  items  needed  for  our  analysis  were  not 
available  in  Portal.  In  particular,  we  found  that  while  many  key  dates  for 
core  C-TPAT  program  activities  were  completed,  other  interim  processing 
dates  that  reflect  the  internal  process  requirements  were  not  available. 

The  absence  of  such  information  from  Portal  not  only  prevents  analysis  by 
external  agencies,  but  also  limits  CBP  management’s  ability  to  monitor 
compliance  with  its  requirements,  assess  the  efficiency  of  C-TPAT 
operations,  and  determine  that  its  processes  are  facilitating  meeting  time 
frames  specified  in  the  SAFE  Port  Act.  For  example,  our  analysis  showed 
that  Portal  does  not  include  data  to  determine  whether  security  specialists 
are  meeting  the  requirement  to  notify  a  company  at  least  30  days  prior  to  a 
validation  visit.  The  date  of  the  initial  validation  meeting  is  captured  in 
Portal,  but  the  date  that  the  security  specialist  sends  the  30-day  validation 
notification  letter  is  not  in  Portal,  making  it  impossible  for  CBP  or 
reviewing  agencies  to  determine  whether  C-TPAT  is  being  run  in 
accordance  with  the  30-day  notice  policy.  Further,  while  Portal  captures 
the  date  that  VSAT  data  are  uploaded  to  the  Portal  system,  the  date  that  a 
security  specialist  returns  to  his  office  after  a  foreign  site  validation  visit  is 


28  CBP  used  C-TPAT  tracker — an  Access  database — to  record  some  information  about  C- 
TPAT  members — as  an  interim  measure  prior  to  Portal  and  subsequently,  the  agency 
migrated  C-TPAT  tracker  data  into  Portal. 

29  As  previously  mentioned,  CBP  migrated  data  from  C-TPAT  tracker  including  information 
on  validations  completed  into  the  Portal  system. 
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not  captured.  As  a  result,  management  is  precluded  from  knowing  whether 
security  specialists  are  meeting  CBP’s  requirement  to  complete  the  VSAT 
within  7  days  of  returning  to  their  office  from  a  foreign  site  visit.  Without 
key  data  being  available  in  Portal,  we  were  not  able  to  complete  our 
assessment  and  CBP  is  limited  in  assessing  the  efficiency  and 
effectiveness  of  C-TPAT. 


CBP  Continues  to  Refine 
Performance  Measures  for 
the  C-TPAT  Program,  but 
Challenges  Remain 


CBP  has  greatly  expanded  its  C-TPAT  program  performance  measures  to 
focus  on  program  participation,  program  administration,  and  the 
internationalization  of  C-TPAT  principles.30  CBP  has  not  yet,  however, 
developed  performance  measures  for  efforts  aimed  at  ensuring  improved 
supply  chain  security  of  C-TPAT  members — a  goal  of  the  program.  CBP’s 
activities  to  develop  performance  measures  have  focused  on  the  areas 
mentioned  and  not  on  data  collected  during  C-TPAT  member  processing 
activities  that  could  support  the  development  of  performance  measures 
for  enhanced  supply  chain  security.  In  our  July  2003  and  March  2005 
reports,  we  commented  that  CBP  was  developing  performance  measures 
with  which  to  measure  the  program’s  success  in  achieving  agency  goals 
and  inform  decisions  for  process  improvement.31  We  recommended  that 
CBP  complete  the  development  of  performance  measures,  to  include 
outcome-based  measures  and  performance  targets,  to  track  the  program’s 
status  in  meeting  its  strategic  goals.32  Furthermore,  under  the  Government 
Performance  and  Results  Act  of  1993  (GPRA),  federal  agencies  are  to 
prepare  an  annual  performance  plan  that  establishes  performance 
indicators  to  be  used  in  measuring  or  assessing  the  relevant  outputs, 
service  levels,  and  outcomes  of  each  of  its  program  activities. 


CBP’s  November  2004  strategic  plan  identified  seven  performance 
measures  that  CBP  developed  for  the  C-TPAT  program,  consistent  with 
recommendations  in  our  2003  and  2005  reports  on  the  program.  These 


30  CBP  seeks  to  internationalize  C-TPAT  principles  to  promote  supply  chain  security  and  to 
facilitate  trade  moving  to  and  between  nations. 

31  See  GAO-03-770  and  GAO-05-404. 

32  The  Government  Performance  and  Results  Act  (GPRA)  provides  the  following 
definitions:  Outcome-based  measure  refers  to  an  assessment  of  the  results  of  a  program 
activity  compared  to  its  intended  purpose;  performance  target  means  a  target  level  of 
performance  expressed  as  a  tangible,  measurable  objective,  against  which  actual 
achievement  shall  be  compared,  including  a  goal  expressed  as  a  quantitative  standard, 
value,  or  rate;  strategic  goals  explain  what  results  are  expected  from  the  agency’s  major 
fimctions  and  when  to  expect  those  results. 
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measures,  shown  in  table  5,  reflect  CBP’s  efforts  in  developing 
performance  measures  at  the  time  the  C-TPAT  strategic  plan  was  issued 
and  are  currently  in  effect.  Table  5  also  shows  the  performance  data  that 
CBP  included  for  two  of  the  seven  measures  in  its  fiscal  year  2006 
performance  and  accountability  report.33 


Table  5:  Performance  Measures  Identified  in  the  C-TPAT  2004  Strategic  Plan 

Program  element  or 

Performance  data 

Performance  measure 

operational  aspect  addressed 

Target/actual 

FY  2005 

FY  2006 

FY  2007 

Percent  of  sea  container  cargo 
transported  by  C-TPAT  members 

Program  partnership 

Percent  of  value  imported  by 

C-TPAT  importers 

Program  partnership 

Percent  of  C-TPAT  importer  volume 

Program  partnership 

Validation  labor  efficiency 

Internationalization  efforts 

Exam  reduction  ratio  between 
C-TPAT  and  non-C-TPAT  importers 

Internationalization  efforts 

Target 

3.5  times 
less 

3.5  times 
less 

3.5  times 
less 

Actual 

4.1  times 
less 

3.4  times 
less 

3.5  times 
less 

Compliance  rate  for  C-TPAT 
members  with  program  security 
guidelines 

Internationalization  efforts 

Target 

98% 

90% 

95% 

Actual 

97% 

98% 

98% 

Time  savings  to  process  US/Mexico 
FAST  lane  transactions 

Internationalization  efforts 

Source:  CBP. 


Note:  The  targets  for  FY  2008  remained  the  same  as  for  FY  2007.  Performance  data  were  not 
available  for  FY  2008. 


C-TPAT  officials  have,  as  part  of  actions  to  revise  the  strategic  plan,  begun 
tracking  additional  measures  of  program  partnership,  program 
administration,  and  the  internationalization  of  C-TPAT  principles.  As  of 
October  1,  2007,  the  C-TPAT  Director  began  requiring  field  directors  and 
supervisors  to  collect  data  on  16  proposed  measures,  as  shown  in  table  6. 


33  Executive  agencies  must  file  an  annual  performance  and  accountability  report  in 
accordance  with  the  GPRA,  Reports  Consolidation  Act,  Homeland  Security  Act,  and  as 
required  by  Office  of  Management  and  Budget  Circular  A-l  1. 
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Table  6:  Performance  Measures  Tracked  for  Evolving  C-TPAT  Strategic  Plan  Used  by  CBP,  as  of  October  1,  2007 

Performance  measure 

Performance  category 

Target 

1 

Reduced  member  examinations 

Program  partnership 

34.4% 

2 

Members’  perceived  faster  or  equal  border  crossing 
times 

Program  partnership 

85.9% 

3 

Members’  intent  to  stay  in  C-TPAT 

Program  partnership 

91.5% 

4 

Members  perceived  timeliness  of  security 
specialists’  responsiveness  to  questions 

Program  partnership 

83.8% 

5 

Members’  perceptions  of  security  specialists’ 
knowledge  level 

Program  partnership 

51 .4%-  very  knowledgeable; 
34.4%  -  knowledgeable;  and  9.8  % 
somewhat  knowledgeable 

6 

Examination  rate  reduction  ratio  for  C-TPAT 
importers  compared  to  non  C-TPAT  importers 

Program  partnership 

No  fewer  than  3.5  times  less  exams 

7 

Compliance  measurement  rate  of  C-TPAT 
importers  compared  to  non  C-TPAT  importers 

Program  partnership 

No  significant  deviation 

8 

Percentage  of  validations  performed  which  result  in 
suspension  or  removal  of  the  member 

Program  partnership 

95%  or  higher  compliance  rate 

9 

Percentage  of  members  suspended  or  removed  as 
a  result  of  a  supply  chain  security  breech 

Program  partnership 

95%  or  higher  compliance  rate 

10 

Percentage  of  applications  reviewed  within  90  days 
of  receipt 

Program  administration 

100%  compliance 

11 

Percentage  of  validations  performed  within  1  year 
of  certification 

Program  administration 

100%  compliance 

12 

Percentage  of  revalidations  performed  within  3 
years  of  original  validation  completion  date 

Program  administration 

100%  compliance 

13 

Percent  of  postincident  analyses  completed  within 

30  days  of  actual  incident 

Program  administration 

100%  compliance 

14 

Random  selection  and  review  of  two  validations  per 
security  specialist  and  VSAT  to  ensure  information 
is  complete,  timely,  and  is  uploaded  in  the  Portal 

Program  administration 

100%  compliance 

15 

Number  of  foreign  customs  administrations’ 
capacity  building  training  activities  supported 
annually 

Internationalization  efforts 

CBP  supports  no  fewer  than  4  trainings  per 

year 

16 

Number  of  countries  that  enter  into  formal  mutual 
recognition  arrangements  with  CBP  annually 

Internationalization  efforts 

CBP  enters  into  mutual  recognition 
arrangements  with  no  fewer  than  2  countries 

per  year 

Source:  GAO  analysis  of  CBP  data. 


CBP  developed  these  measures  to  address  various  aspects  of  the  C-TPAT 
program — including  management  oversight,  program  benefits  and  costs, 
member  satisfaction,  and  internationalization  of  C-TPAT  principles — and 
to  record  program  activity.  The  absence  of  performance  measures  for 
enhanced  security  indicates  that  CBP  has  yet  to  develop  measures  that 
assess  C-TPAT’s  progress  toward  achieving  its  strategic  goal  to  ensure  that 
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its  members  improve  the  security  of  their  supply  chains  pursuant  to 
C-TPAT  security  criteria. 

As  part  of  its  effort  to  develop  additional  performance  measures,  CBP — in 
response  to  one  of  our  2005  recommendations — funded  a  university 
research  initiative  to  identify  how  C-TPAT  has  affected  the  operations  of 
member  companies  and  the  perceived  membership  incentives  and 
benefits.  The  University  of  Virginia  Center  for  Survey  Research  conducted 
a  survey  of  certified  C-TPAT  members  as  of  December  1,  2006,  and  1,756 
of  nearly  6,000  companies  (29  percent)  responded.  The  survey 
respondents  provided  their  perceptions  about  costs,  benefits,  and  impacts 
of  participation  in  the  C-TPAT  program.  However,  given  that  the  response 
rate  was  only  29  percent,  and  absent  any  additional  data  that  would 
suggest  that  the  respondents  were  representative  of  the  C-TPAT 
membership,  we  cannot  determine  whether  the  results  of  the  survey  are 
truly  representative  of  the  views  of  the  C-TPAT  membership  as  a  whole. 

The  report  that  the  University  of  Virginia  issued  in  August  2007  in  response 
to  this  survey  affirmed  that  a  majority  of  C-TPAT  members  responding 
stated  they  would  remain  in  the  program.  The  report  also  stated  that  a 
majority  of  the  C-TPAT  members  identified  as  importers  said  that  an 
extremely  important  motivation  for  joining  the  C-TPAT  program  is 
reducing  disruptions  in  the  supply  chain.  In  addition,  all  businesses 
responding  stated  that  they  joined  the  C-TPAT  program  to  reduce  the  time 
and  cost  of  cargo  getting  released  by  CBP  and  viewed  implementation  and 
maintenance  of  physical  security  and  maintenance  of  in-house  education, 
training,  and  awareness  as  significant  costs  of  program  membership. 
Additionally,  nearly  one-third  of  the  C-TPAT  members  who  responded 
believed  the  program  benefits  outweighed  costs  and  nearly  a  quarter  of 
members  who  responded  believed  costs  were  roughly  the  same  as 
benefits.  Also,  at  a  minimum,  about  one-quarter  of  C-TPAT  member  survey 
respondents  noted  that  tangible  benefits  included  improvements  in 
workforce  security,  time  of  release  and  inspection  of  cargo  by  CBP,  and 
predictability  in  moving  goods.  Further,  over  one-half  of  C-TPAT  members 
responding  identified  enhanced  cargo  security,  demonstration  of 
corporate  citizenship,  and  improved  risk  management  as  extremely 
important  intangible  benefits.  In  contrast,  more  than  half  of  nonimporters 
that  responded  indicated  that  they  joined  the  C-TPAT  program  because 
their  business  members  required  them  to  be  C-TPAT  certified.  While  these 
study  results  indicated  the  benefits  and  costs  of  C-TPAT  membership  as 
expressed  by  survey  respondents,  the  study  was  not  designed  to  assess 
C-TPAT’s  impact  on  supply  chain  security. 
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CBP  collects  information  in  its  C-TPAT  member  processing  activities  that 
may  provide  direction  for  developing  performance  measures  of  enhanced 
supply  chain  security.  For  example,  during  the  course  of  a  company’s 
membership  in  C-TPAT,  CBP  security  specialists  observe  the  company’s 
security  practices  from  the  filing  of  the  company’s  initial  security  profile 
through  validation  of  its  practices  and  the  filing  of  annual  company 
security  profile  updates.  Thus,  CBP  is  in  a  position  to  identify  security 
changes  and  improvements  that  could  provide  a  measure  of  enhanced 
supply  chain  security.  The  recommendations  in  validation  reports 
represent  opportunities  for  companies  to  improve  their  supply  chain 
security  and  could  point  to  areas  where  C-TPAT  has  a  measurable  impact. 
With  an  appropriate  recommendation  follow-up  system  to  document 
companies’  security  improvements,  CBP  could  develop  measures  of 
improved  supply  chain  security.  Similar  opportunities  occur  with 
revalidations  and  C-TPAT  members’  annual  security  profile  updates.  If 
CBP  does  the  appropriate  follow  up  and  review  to  determine  that 
proposed  or  stated  security  actions  have  actually  been  implemented, 
supply  chain  security  could  be  enhanced.  For  example,  if  security  data 
collected  using  VSAT  show  that  a  periodic  company  inspection  identified  a 
security  weakness  that  the  company  resolved,  CBP  could  track  and 
summarize  such  examples  over  time  as  measures  of  the  extent  to  which 
C-TPAT  has  contributed  to  enhanced  supply  chain  security. 

We  acknowledge  and  accept  CBP’s  assessment  that  the  challenge  to 
develop  outcome-based  performance  measures  for  C-TPAT  is  a  difficult 
one  given  that  effectiveness  is  difficult  to  measure  in  terms  of  deterrence 
because  the  direct  impact  of  a  program  on  unlawful  activity  is  generally 
unknown.  However,  CBP  remains  subject  to  the  GPRA  requirement  that 
federal  agencies  develop  outcome-based  measures  to  assess  the  results  of 
a  program  activity  compared  to  its  intended  purpose.  Without  outcome- 
based  performance  measures  on  which  to  base  program  evaluations,  CBP 
will  not  be  able  to  assess  the  effectiveness  of  C-TPAT  as  it  contributes  to 
homeland  security. 


Conclusions 


CBP  has  taken  valuable  steps  in  developing  partnerships  within  the  trade 
community  to  improve  supply  chain  security  while  maintaining  the  flow  of 
commerce.  Developing  partnerships  is  particularly  challenging  given  the 
international  nature  of  the  trade  community  and  the  resulting  limits  on 
CBP’s  jurisdiction  and  activities.  While  the  benefits  offered  through 
C-TPAT  make  membership  worthwhile  for  many  companies,  it  is  vital  that 
CBP  maintain  adequate  internal  controls  to  ensure  that  member 
companies  deserve  these  benefits.  CBP  has  been  responsive  to  our  prior 
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concerns  but  still  needs  to  take  several  important  steps  to  provide 
Congress  with  further  assurance  that  C-TPAT  is  working  as  intended. 

CBP  developed  the  VSAT  to  conduct  more  consistent  validations,  but  the 
VSAT  is  limited  in  its  effectiveness.  CBP  also  does  not  follow  up  on 
validation  report  recommendations  to  determine  if  members  are  actually 
implementing  measures  to  enhance  supply  chain  security.  This  represents 
another  lost  opportunity  to  fulfill  the  very  purpose  of  validations. 
Moreover,  data  from  validations  are  not  being  routinely  used  to  inform 
CBP  about  strengths  and  vulnerabilities  in  C-TPAT  members’  supply  chain 
security.  Collectively,  these  data  could  make  it  possible  for  CBP  to  move 
closer  to  establishing  performance  measures  for  supply  chain  security. 

Further,  a  review  of  selected  records  in  C-TPAT  Portal  showed  that 
security  specialists  often  omitted  entering  interim  processing  dates  into 
the  system — dates  which  would  document  processing  times  and  company 
waiting  periods.  Without  these  dates,  CBP  cannot  determine  whether  its 
processes  are  facilitating  the  meeting  of  time  frames  specified  in  the  SAFE 
Port  Act  or  ensuring  it  is  meeting  its  own  standards.  Finally,  without 
outcome-based  performance  measures  on  which  to  evaluate  the  program, 
CBP  will  not  be  able  to  assess  the  effectiveness  of  C-TPAT  as  it 
contributes  to  homeland  security. 


Recommendations 
Executive  Action 


To  improve  CBP’s  implementation  of  SAFE  Port  Act  provisions  and  to 
strengthen  C-TPAT  program  management,  ensure  adequate  internal 
controls  to  manage  the  program,  provide  management  with  complete 
program  data  for  decision  making,  and  establish  indicators  of  the 
program’s  impact  on  supply  chain  security,  we  recommend  that  the 
Secretary  of  Homeland  Security  direct  the  Commissioner  of  U.S.  Customs 
and  Border  Protection  to  take  the  following  five  actions: 


(1)  Continue  to  improve  the  consistency  with  which  validations  are 
conducted  and  documented  by  revising  the  electronic  instrument  used 
in  validations  to  include  appropriate  response  options  and  eliminate 
the  use  of  default  “no”  responses. 

(2)  Strengthen  the  evaluation  of  security  during  validations  by  requiring 
validations  to  include  the  review  and  assessment  of  any  available 
results  from  audits,  inspections,  or  other  reviews  of  a  member’s  supply 
chain  security. 
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(3)  Ensure  that  C-TPAT  validation  report  recommendations  are 
implemented  by  establishing  a  policy  for  security  specialists  to  follow 
up  with  member  companies  when  CBP  requires  them  to  make  security 
enhancements  to  ensure  that  the  necessary  steps  are  taken. 

(4)  Ensure  that  the  C-TPAT  Portal  records  management  system 
completely  documents  key  data  elements  needed  to  track  compliance 
with  SAFE  Port  Act  and  other  CBP  internal  requirements. 

(5)  Identify  and  pursue  opportunities  in  information  collected  during  C- 
TPAT  member  processing  activities  that  may  provide  direction  for 
developing  performance  measures  of  enhanced  supply  chain  security. 


Agency  Comments 


We  provided  a  draft  of  this  report  to  the  Secretary  of  Homeland  Security 
for  review  and  comment.  We  received  comments  from  DHS  and  CBP  that 
are  reprinted  in  appendix  III.  DHS  and  CBP  agreed  with  our 
recommendations  and  outlined  actions  that  CBP  plans  to  take  to 
implement  them.  CBP  also  provided  technical  comments,  which  we  have 
incorporated  into  the  report  as  appropriate. 


We  plan  no  further  distribution  of  this  report  until  30  days  after  its  issue 
date.  At  that  time,  we  will  provide  copies  of  this  report  to  appropriate 
departments  and  interested  congressional  committees.  We  will  also  make 
copies  available  to  others  upon  request.  In  addition,  the  report  will  be 
available  at  no  charge  on  GAO’s  Web  site  http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  about  this  report,  please  contact  me 
at  (202)  512-9610  or  at  caIdwells@gao.gov.  Key  contributors  to  this  report 
are  listed  in  appendix  V. 


Stephen  L.  Caldwell 

Director,  Homeland  Security  and  Justice  Issues 
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Objectives  This  appendix  discusses  the  objectives,  scope  and  methodology  of  our 

review  of  the  U.S.  Customs  and  Border  Protection’s  (CBP)  Customs-Trade 
Partnership  Against  Terrorism  (C-TPAT)  program.  In  our  March  2005 
report  on  C-TPAT,1  we  made  several  recommendations  to  help  CBP 
achieve  C-TPAT  objectives  and  address  the  challenges  associated  with  its 
continued  development,  including  recommendations  to  (1)  strengthen  the 
validation  process  by  providing  appropriate  guidance  to  security 
specialists  conducting  validations;  (2)  implement  a  records  management 
system  that  accurately  and  timely  documents  key  decisions  and  significant 
operational  events;  and  (3)  complete  the  development  of  performance 
measures,  to  include  outcome-based  measures  and  performance  targets. 
Recognizing  the  importance  of  the  C-TPAT  program,  congressional 
requesters  asked  GAO  to  conduct  another  review.  The  following 
discussion  addresses  our  objectives  and  how  we  performed  the  review. 

We  addressed  the  following  questions  regarding  C-TPAT: 

•  What  has  CBP  done  to  strengthen  its  policies  for  awarding  benefits  to 
companies  that  participate  in  C-TPAT  in  response  to  our  2005  report? 

•  What  progress  has  CBP  made  in  addressing  challenges  in  its  processes 
for  validating  C-TPAT  companies’  security  processes  that  we  identified 
in  our  2005  report? 

•  What  actions  has  CBP  taken  since  2005  to  address  overall  management 
and  staffing  challenges  of  the  C-TPAT  program  and  ensure  that  the 
program  operates  as  intended? 


Scope  arid  Methodology  To  address  the  three  questions  or  objectives,  we  discussed  C-TPAT 

program  operations  with  officials  from  CBP  headquarters  in  Washington, 
D.C.  and  the  five  C-TPAT  field  locations:  (1)  Washington,  D.C.;  (2)  Los 
Angeles,  California;  (3)  Miami,  Florida;  (4)  Newark,  New  Jersey;  and  (5) 
New  York,  New  York.  We  reviewed  current  federal  laws  and  regulations 
including  the  Security  and  Accountability  for  Every  Port  (SAFE  Port)  Act 
of  2006.  We  also  reviewed  pertinent  GAO  reports. 

More  specifically,  to  address  our  first  objective  on  policies  for  awarding 
benefits  to  C-TPAT  participants,  we  reviewed  CBP’s  minimum  security 


1  GAO-05-404. 
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criteria  that  had  been  issued  as  of  November  2007.  We  discussed  the 
criteria’s  development  with  CBP  and  C-TPAT  program  officials.  We  also 
reviewed  CBP’s  tiered  benefits  structure  for  C-TPAT  importers  and 
subsequent  requirements  under  the  SAFE  Port  Act  for  tiering  the  benefits 
awarded  C-TPAT  participants.  The  tiered  benefits  concept  involves 
providing  limited  benefits  initially  and  delaying  additional  benefits  until 
validation  of  the  C-TPAT  member’s  security  practices. 

To  address  our  second  objective  on  CBP’s  progress  in  addressing 
challenges  in  its  process  for  validating  the  security  practices  of  companies 
in  the  C-TPAT  program,  we  reviewed  a  sample  of  419  validations 
completed  from  March  1,  2006,  through  September  30,  2006.  In  addition, 
we  selected  a  nonprobability  sample  of  26  validation  cases  and  conducted 
a  more  detailed  review  that  included  examining  hard-copy  records  and 
other  data,  such  as  notes  taken  by  the  security  specialists  during  validation 
visits  to  members’  facilities,  not  available  for  the  broader  sample.  The 
results  of  this  review  are  not  generalizable  beyond  the  subset  examined. 
However,  because  we  selected  the  validation  cases  based  on  the  variety  of 
their  field  office  location,  role  in  the  supply  chain,  use  and  nonuse  of 
CBP’s  automated  validation  instrument,  and  type  of  validation 
questionnaire  used,  they  provided  us  with  an  overall  understanding  of 
validation  activities  and  documents  collected  during  validation  site  visits. 
We  selected  these  cases  because  they  represented  validations  of  the 
following  trade  sectors  in  the  supply  chain:  (1)  foreign  logistic  service 
providers;  (2)  foreign  manufacturers;  (3)  foreign  port  or  terminal 
operators;  (4)  non-U.S.  importers;  (5)  U.S.  importers;  and  (6)  others,  such 
as  sea  carriers.  At  the  CBP  field  locations  where  we  performed  the 
detailed  reviews,  we  also  discussed  the  validation  process  with  11  supply 
chain  security  specialists  who  conduct  C-TPAT  validations.  These 
specialists  provided  descriptive  information  about  their  data  collection, 
documentation,  and  report  preparation  practices  for  C-TPAT  validations. 
They  were  selected  by  CBP  based  on  their  availability  and  their  views  are 
not  generalizable  beyond  those  interviewed.  Nonetheless,  because  the 
specialists  were  selected  nonsystematically  and  by  chance  and  included  a 
wide  range  of  experience  in  the  specialist  position,  their  interview 
statements  provided  broad-based,  realistic  personal  descriptions  of  what 
occurs  in  CBP’s  validation  process  for  C-TPAT  members. 

We  also  reviewed  GAO’  and  Office  of  Management  and  Budget  guidance 
on  internal  controls  to  assess  the  extent  to  which  CBP  has  incorporated 
them  into  the  C-TPAT  program.  We  also  obtained  information  on  the 
automated  instrument  that  CBP  developed  for  use  in  the  validation 
process  and  reviewed  the  instrument’s  application  in  our  sample  of  cases. 
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Finally,  we  reviewed  the  items  in  the  automated  instrument  and  compared 
them  with  the  minimum  security  criteria  for  U.S.  importers.  Although  our 
sample  of  419  validations  included  329  validations  using  the  automated 
instrument,  analysis  of  the  instrument's  use  was  not  possible  due  to  data 
reliability  issues  concerning  flaws  in  the  instrument’s  design  (see  below). 
We  also  compared  the  C-TPAT  minimum  security  criteria  for  importers  to 
the  three  questionnaires  that  comprise  the  automated  instrument.2 

To  address  our  third  objective  on  CBP’s  actions  since  2005  to  address 
management  and  staffing  challenges  to  ensure  that  the  C-TPAT  program 
operates  as  intended,  we  interviewed  officials  from  CBP  headquarters  in 
Washington,  D.C.  In  addition,  we  reviewed  documentation  on  C-TPAT 
Portal,  which  is  CBP’s  records  management  system.  In  reviewing  our 
sample  of  419  validations,  we  reviewed  the  information  in  Portal  that 
provides  C-TPAT  management  with  the  internal  control  to  manage  the 
program.  CBP  sent  the  original  Portal  data  of  the  419  validation  cases  in 
February  2007  and  then  sent  updated  Portal  data  for  the  same  cases  in 
August  2007  to  provide  us  with  current  information  on  the  cases.  In 
addition,  we  obtained  and  reviewed  the  2005  human  capital  plan  and  2007 
annual  plan  for  information  on  how  CBP  plans  to  meet  its  staffing 
requirements  to  achieve  C-TPAT  program  goals.  In  addition,  we  reviewed 
the  2004  C-TPAT  strategic  plan,  CBP  strategic  plan  for  fiscal  years  2005- 
2010,  and  the  fiscal  year  2006  CBP  Performance  and  Accountability  Report 
for  conformance  with  Government  Performance  and  Results  Act  of  1993 
(GPRA)  structural  requirements  and  for  performance  measures  that  show 
how  well  the  program  is  meeting  its  goals.  Finally,  we  obtained  and 
reviewed  CBP’s  2007  C-TPAT  study  of  members’  program  participation 
benefits  and  costs,  conducted  by  the  University  of  Virginia  Center  for 
Survey  Research,  to  assess  how  CBP  plans  to  use  the  results  in  the 
development  of  performance  measures. 

We  conducted  this  performance  audit  from  May  2006  to  April  2008  in 
accordance  with  generally  accepted  government  auditing  standards.  Those 
standards  require  that  we  plan  and  perform  the  audit  to  obtain  sufficient, 
appropriate  evidence  to  provide  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives.  We  believe  that  the  evidence 
obtained  provides  a  reasonable  basis  for  our  findings  and  conclusions 
based  on  our  audit  objectives. 


2  CBP  issued  its  first  minimum  security  criteria  for  importers  in  March  2005  and,  according 
to  CBP  officials,  the  criteria  are  representative  of  C-TPAT  criteria  in  general. 
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To  assess  the  reliability  of  CBP’s  data  on  member  status  in  C-TPAT — 
management  data  in  Portal  and  validation  data  in  VSATs — we  (1)  reviewed 
existing  documentation  related  to  the  data  sources,  (2)  electronically 
tested  the  data  to  identify  apparent  problems  with  completeness  or 
accuracy,  and  (3)  questioned  knowledgeable  agency  officials  about 
controls  over  the  integrity  of  the  data.  Initial  reliability  testing  of  the 
databases  and  interviews  of  staff  with  responsibility  for  the  program  led  us 
to  conclude  that  data  used  to  track  participant  status  and  VSAT 
information  had  some  weaknesses  that  could  cause  concerns  with  the 
reliability  of  the  data.  In  particular,  in  the  Portal  database,  certain  key 
data,  such  as  interim  processing  dates  needed  to  calculate  processing  time 
frames,  were  missing  that  did  not  permit  a  complete  analysis.  We 
determined  that  the  data  from  Portal  were  sufficiently  reliable  for  the 
limited  use  of  describing  the  program  status,  such  as  the  approximate 
numbers  of  participants  and  number  of  validations,  since  our  analysis  and 
discussions  with  CBP  officials  assured  us  that  those  data  fields  were 
reasonably  complete  and  accurate. 

For  the  VSAT  database,  an  analysis  of  much  of  the  data  collected  through 
the  use  of  the  instrument  was  not  possible  due  to  reliability  issues  with  the 
data  resulting  from  limitations  in  the  design  of  the  instrument.  For 
example,  the  automated  instrument  is  designed  to  yield  responses  in  a 
binary  format  (i.e.,  “yes/no”  responses),  with  “no”  as  an  automatic  default 
response.  Therefore,  if  a  response  is  marked  “no,”  it  is  unclear  whether  the 
question  was  intentionally  answered  “no”  or  whether  the  response  was  an 
automatic  default.  Furthermore,  completion  of  many  items  on  the  VSAT 
questionnaire  is  optional  (not  mandatory);  therefore,  it  is  not  possible  to 
determine  the  validity  of  the  responses  to  the  questions  that  cover  the  C- 
TPAT  criteria  in  the  seven  defined  security  areas.  As  a  result,  we  deemed 
the  VSAT  data  insufficiently  reliable  for  analytical  purposes,  though  since 
nearly  all  the  VSATs  had  at  least  one  completed  numerical  assessment 
score,  we  deemed  these  scores  sufficiently  reliable  to  use  to  select  our  25 
validation  cases  for  more  in  depth  review. 
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This  appendix  provides  information  on  U.S.  Customs  and  Border 
Protection’s  (CBP)  efforts  to  use  third  parties  to  conduct  validations  in 
China,  where  CBP  currently  lacks  full  access.  The  Chinese  government 
does  not  allow  CBP  personnel  access  to  conduct  supply  chain  security 
validations  in  China.  The  Security  and  Accountability  for  Every  Port  (or 
SAFE  Port)  Act  of  2006  requires  CBP  to  develop  a  plan  to  implement  a  1- 
year  voluntary  pilot  program  to  test  and  assess  the  feasibility,  costs,  and 
benefits  of  using  third  party  entities  to  conduct  validations  of  Customs- 
Trade  Partnership  Against  Terrorism  (C-TPAT)  program  participants.  CBP 
established  the  program  in  May  2007.  This  appendix  discusses  the  pilot’s 
initiation  and  its  policies  and  procedures. 

CBP’s  third  party  validation  pilot  program  provides  the  opportunity  for 
qualified  contractors  to  validate  C-TPAT  member  international  supply 
chain  participants  in  China.  CBP  recognized  its  inability  to  validate  the 
security  of  C-TPAT  members’  supply  chains  in  China  as  an  opportunity  (1) 
to  conduct  the  pilot  as  mandated  by  the  SAFE  Port  Act  and  (2)  for  C-TPAT 
members  importing  solely  from  China  to  be  validated  and  possibly  receive 
Tier  2  or  3  benefits.  According  to  CBP,  C-TPAT  members  that  import 
solely  from  China  are  not  receiving  the  highest  C-TPAT  benefits  to  which 
they  may  be  entitled  because  CBP’s  security  specialists  are  prohibited  by 
the  Chinese  government  from  validating  foreign  supply  chains  in  their 
country.  CBP  compiled  a  list  of  importers  eligible  for  the  pilot — those  who 
source  76  percent  or  more  of  their  imports  from  China — and  identified  11 
contractors  qualified  to  perform  the  validations.  The  pilot  program  is 
voluntary,  and  as  outlined  in  the  SAFE  Port  Act,  any  C-TPAT  member 
wishing  to  participate  must  agree  to  validation  by  a  third  party  contractor 
and  pay  all  costs  for  this  service.  Also,  CBP  retains  the  authority  to  make 
validation  findings  and  tier  status  determinations  based  on  the  data 
gathered  and  submitted  by  third  party  validators  in  their  electronic 
checklist  or  questionnaire.  Of  304  C-TPAT  member  companies  eligible  to 
participate  in  the  pilot,  as  of  December  2007,  14  had  expressed  an  interest 
in  doing  so  and  1  had  actually  gone  through  validation  with  a  third  party 
validator. 

CBP  developed  standard  operating  procedures  as  guidelines  for  ensuring 
that  third  party  contractors  follow  necessary  procedures  in  validating  a 
C-TPAT  member.  In  March  2007,  CBP  posted  an  announcement  of  the  pilot 
on  the  Federal  Business  Opportunities  website  that  included  third  party 
requirements,  duties  to  be  performed  by  the  third  party  firm,  and  standard 
operating  procedures  for  the  pilot.  Specifically,  third  party  validation  firms 
selected  were  required  to  sign  confidentiality  agreements,  maintain 
liability  insurance,  apply  for  protections  under  the  Support  Anti-terrorism 
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by  Fostering  Effective  Technologies  Act  of  2002,  and  remain  free  from 
conflicts  of  interest,  including  having  any  direct  or  indirect  control  over 
the  company  which  is  being  validated.  Also,  third  party  firms  must  provide 
CBP  with  documentation  of  their  training  procedures  for  validators, 
including  information  on  the  scope  of  the  training  and  type  of  material 
presented  to  sufficiently  establish  the  validator’s  knowledge  of  the  C-TPAT 
program,  the  international  supply  chain,  and  the  transportation  and 
logistics  industry.  In  completing  and  reporting  on  validations,  third  parties 
are  required  to: 

(1)  perform  the  validations  in  accordance  with  C-TPAT  importer  minimum 
security  criteria; 

(2)  properly  document  all  validation  findings,  recommendations,  and 
actions  required  in  an  electronic  checklist  or  questionnaire  format, 
consistent  with  all  CBP  importer  minimum  security  criteria; 

(3)  acknowledge  to  CBP  that  written  procedures  were  on  hand  and 
reviewed  by  the  validator  to  verify  the  information  provided  by  the 
company  being  validated;  and 

(4)  submit  the  electronic  security  checklist  or  questionnaire  and  other 
associated  validation  information  to  CBP  within  15  working  days  after 
completion  of  the  validation. 

CBP  has  not  provided  the  Validation  Security  Assessment  Tool  (VSAT) 
that  its  security  specialists  use  in  validations  for  third  party  validators  to 
use  when  validating  C-TPAT  members  as  part  of  the  pilot  program. 
Validation  information,  developed  separately  by  the  11  selected  validator 
companies,  will  likely  vary  among  the  validators  and  differ  from  the  VSAT 
used  by  the  CBP  security  specialists.  CPB  plans  to  transfer  the  electronic 
information  provided  by  third  party  validators  onto  a  VSAT  questionnaire 
and  follow  up  as  necessary  with  the  third  party  validator  and  the  C-TPAT 
member,  but  CBP  has  not  established  a  standard  operating  procedure  for 
reviewing  the  electronic  information  and,  according  to  CBP  officials,  has 
no  plans  to  do  so  given  the  low  number  of  members  that  have  used  the 
third-party  validator  option.  As  of  December  14,  2007,  only  lof  304  C-TPAT 
members  eligible  to  use  a  third  party  validator  had  actually  done  so  and 
CBP  had  not  yet  received  the  electronic  results  of  the  validation. 
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In  October  2007,  the  Department  of  Homeland  Security  Assistant  Secretary 
for  Policy  said  interest  in  the  pilot  program  had  been  minimal.1  According 
to  the  Assistant  Secretary,  the  primary  concerns  expressed  by  C-TPAT 
members  involve  sharing  proprietary  and  business  data  with  a  third  party 
and  the  costs  associated  with  the  validation,  which,  as  outlined  in  the 
SAFE  Port  Act,  must  be  incurred  by  C-TPAT  members. 


1  Statement  of  Stewart  Baker,  Assistant  Secretary  for  Policy,  DHS,  at  a  hearing  before  the 
Committee  on  Homeland  Security  and  Governmental  Affairs,  U.S.  Senate,  October  16,  2007. 
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li.S.  Department  of  Homeland  Security 

Washington.  DC  20528 


•HI*  Homeland 
W  security 


April  8,  2008 


Mr.  Stephen  L.  Caldwell 
Director,  Homeland  Security  and  Justice  Issues 
U.S.  Government  Accountability  Office 
Washington,  D.  C.  20548 

Dear  Mr.  Caldwell: 

Thank  you  for  providing  us  with  a  copy  of  the  draft  report  entitled  “SUPPLY  CHAIN 
SECURITY:  U.S.  Customs  and  Border  Protection  Has  Enhanced  Its  Partnership  with 
Import  Trade  Sectors,  but  Challenges  Remain  in  Verifying  Practices”  (GAO-08-240), 
which  examines  U.S.  Customs  and  Border  Protection’s  (CBP)  Customs-Trade  Partnership 
Against  Terrorism  (C-TPAT)  program.  This  report  assessed  the  progress  CBP  has  made 
since  2005  in  1)  improving  its  benefit  award  policies  for  C-TPAT  members,  2)  addressing 
challenges  in  validating  members’  security  practices,  and  3)  addressing  management  and 
staffing  challenges. 

The  Department  of  Homeland  Security  (DHS)  and  CBP  concur  with  GAO’s  observations  that 
CBP  continues  to  improve  the  consistency  with  which  validations  are  conducted,  strengthen  the 
evaluation  of  security  during  validations,  ensuring  that  C-TPAT  validation  report 
recommendations  are  implemented,  ensure  that  the  C-TPAT  Portal  records  management  system 
completely  documents  all  decision  making  and  identifies  and  pursues  opportunities  m 
information  collected  during  C-TPAT  member  processing  activities. 

CBP  would  like  to  emphasize  that  C-TPAT  is  an  integral  part  of  the  CBP  multi-layered  strategy 
through  which  CBP  works  in  partnership  with  the  trade  community  to  better  secure  goods 
moving  through  the  international  supply  chain.  C-TPAT  has  enabled  CBP  to  leverage  supply 
chain  security  throughout  international  locations  where  CBP  has  no  regulatory  reach. 

In  Fiscal  Year  2009,  C-TPAT  will  focus  its  efforts  on  strengthening  the  partnership  with 
member  companies  at  both  the  macro  and  micro  levels  and  leveraging  corporate  influence 
throughout  the  international  supply  chain.  In  doing  so,  C-TPAT  will  continue  to  ensure 
compliance  with  the  requirements  of  the  SAFE  Port  Act  to  include  certifying  security  profiles 
within  90  days  of  submission  and  conducting  validations  within  one  year  of  certificauon  an 
revalidations  within  4-years  of  initial  validation.  C-TPAT  projects  that  3800-4500  validations 
will  be  required  during  FY  2009,  requiring  on  site  visits  at  facilities  throughout  the  world. 

In  strengthening  this  successful  program,  CBP  will  also  continue  to  review  its  performance 
and,  where  needed,  enhance  the  minimum  security  criteria  for  each  enrollment  sector. 
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Additionally  CBP  will  continue  to  conduct  informational  and  training  sessions  for  various 
intemal/extemal  audiences  to  improve  knowledge  of  cargo  security  procedures  and  provide  the 
latest  information  regarding  terrorism  trends  and  conveyance  breaches. 

Another  important  effort  to  note  is  the  potential  mutual  recognition  of  other  countries’  customs- 
to-business  partnership  programs.  The  World  Customs  Organization  has  developed  a  global 
standard  for  trusted  partnerships  with  the  trade,  known  as  the  Authorized  Economic  Operato  , 
or  AEO,  program.  This  concept  is  similar  to  the  C-TPAT  program.  Mutual  Recognition 
Arrangements  reduce  costs  and  simplify  these  programs  for  both  industry  and  government. 

CBP  is  engaged  in  mutual  recognition  discussions  with  several  governments  mid  is  following  a 
very  methodical  process  to  achieve  recognition.  These  programs  must  meet  three 
requirements:  they  must  be  security-based;  they  must  be  operational;  and  they  must  have  a 
minimum  level  of  validation  to  verify  the  company  has  done  what  it  claims  to  have  done. 

Creating  an  international  network  to  exchange  information  about  trusted  traders  and  knowing 
that  those  participants  are  observing  specified  security  standards  in  the  secure  hand  mg  o 
goods  and  relevant  information  is  a  win-win  for  both  government  and  business.  In  June  2007, 
CBP  signed  its  first  mutual  recognition  arrangement  with  New  Zealand  and  CBP  is  beginning 
to  see  several  positive  outcomes  and  challenges  taking  form  as  the  work  to  implement  that 
arrangement  continues. 

Attached  are  comments  specific  to  the  recommendations.  Please  note  that  CBP  understands 
that  GAO  has  made  changes  to  recommendations  4  and  5.  CBP  requested  that  GAO  reword 
the  recommendations  and  it  is  our  understanding  that  the  changes  agreed  to  will  be  captured  m 
the  final  report.  CBP’s  corrective  action  plans  are  based  upon  the  revised  recommendations. 

With  regard  to  the  classification  of  the  draft  report,  CBP  has  not  identified  information  within  ^ 
the  report  requiring  restricted  public  access  based  on  a  designation  of  “For  Official  Use  Only. 

Recommendation  1 :  Continue  to  improve  the  consistency  with  which  validations  are 
conducted  and  documented  by  revising  the  electronic  instrument  used  m  validations  to  include 
appropriate  response  options  and  eliminate  the  use  of  default  ‘"no’  responses. 

Response:  Concur.  CBP  is  developing  a  second  generation  automated  tool  which  will 
eliminate  the  use  of  default  “no”  response  and  will  address  all  security  criteria. 

Due  Date:  Phased  in  approach  on  a  sector-by-sector  basis  over  the  next  12  months. 

1.  Phase  1  to  be  completed  by  June  30, 2008. 

2.  Additional  sectors  will  be  identified  and  roll-out  scheduled  determined  by  August  30, 
2008 

3.  Additional  automated  reports  to  be  operational  by  December  31, 2008. 

Recommendation  2:  Strengthen  the  evaluation  of  security  during  validations  by  requiring 
validations  to  include  the  review  and  assessment  of  any  available  results  from  audits, 
inspections,  or  other  reviews  of  a  member  s  supply  chain  security. 
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Response:  Concur.  CBP  will  issue  a  policy  memo  to  the  Security  Specialists  instructing  them 
to  request  from  the  partner  company  any  available  internal  audits,  inspections  or  reviews  which 
will  serve  as  additional  information  to  consider  during  the  validation  process. 

Due  Date:  C-TPAT  Headquarters  will  issue  the  policy  memorandum  by  June  30, 2008  and 
will  include  this  topic  at  its  fall  2008  internal  training  session. 

Recommendation  3:  Ensure  that  C-TPAT  validation  report  recommendations  are  implemented 
by  establishing  a  policy  for  security  specialists  to  follow-up  with  member  companies  when 
CBP  requires  them  to  make  security  enhancements  to  ensure  that  the  necessary  steps  are  taken. 

Response:  Concur.  CBP  will  issue  a  policy  memorandum  and  revise  Standard  Operating 
Procedures  to  the  extent  necessary  to  ensure  that  all  actions  required  /  recommendations  are 
implemented  and  will  explore  ways  to  capture  and  quantify  this  information  either  m  the  Portal 
records  management  system  or  via  other  means. 

Due  Date1  C-TPAT  Headquarters  will  implement  tire  policy  change  by  June  30,  2008  and 
immediately  begin  to  identify  Portal  enhancements  with  the  goal  of  accomplishing  system 
changes  by  December  31, 2008. 

Recommendation  4:  Ensure  that  the  C-TPAT  Portal  records  management  system  completely 
documents  key  data  elements  needed  to  track  compliance  with  SAFE  Port  Act  and  other  CBP 
internal  requirements. 

Response:  Concur.  GAO  cites  two  specific  examples  of  data  elements  (dates)  which  it 
believes  C-TPAT  managers  and  3rd  party  reviewers)  need  to  ensure  compliance  with  certain 
aspects  of  the  program  e.g.  the  date  the  validation  letter  is  sent  to  the  member  and  the  date  the 
VS  AT  information  is  uploaded  into  the  portal. 

CBP  believes  that  priority  should  be  placed  on  capturing  those  dates  /  milestones  which  will 
establish  compliance  with  the  performance  measures  identified  in  Table  6  of  the  report  with 
specific  emphasis  on  SAFE  Port  Act  mandates,  i.e.  certify  within  90  days,  initiate validation 
within  1  year  of  the  date  of  validation  and  revalidate  within  3  years  of  the  date  of  initial 
validation. 

C-TPAT  Headquarters  will  ensure  the  data  elements  needed  to  ensure  compliance  with  the 
performance  indicators  stated  in  the  October  1, 2007  memorandum  and  as  identified  Table  6 
are  available  in  the  Portal  records  system. 

Due  Date:  June  30, 2008 

Recommendation  5:  Identify  and  pursue  opportunities  in  information  collected  during 
C-TPAT  member  processing  activities  that  may  provide  direction  for  developing  performance 
measures  of  enhanced  supply  chain  security. 
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Response:  Concur.  CBP  agrees  that  the  C-TPAT  program  must  continue  to  strive  to  develop 
outcome  based  measures  and  CBP  will  conduct  an  analysis. 

Due  Date:  December  31,  2008. 

We  thank  you  again  for  the  opportunity  to  review  this  important  report  and  provide  comments. 


Sincerely, 


Penelope  G.  McCormack 
Acting  Director 

Departmental  GAO/OIG  Liaison  Office 
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This  appendix  provides  information  on  C-TPAT  members  receiving  tiered 
benefits.  Beginning  with  C-TPAT’s  inception  in  November  2001through 
December  31,  2007,  CBP  validated  79.1  percent  (6,290)  of  C-TPAT’s 
certified  member  companies.  As  shown  in  table  7,  39.9  percent  (2,512)  of 
the  validated  members  were  importers,  of  which  88.3  percent  (2,219)  were 
awarded  Tier  2  benefits,  9.3  percent  (233)  were  awarded  Tier  3  benefits, 
and  2.4  percent  (60)  were  suspended  or  removed  from  the  program. 
Importers  receiving  Tier  1  benefits  made  up  60.4  percent  (1,001)  of 
certified  CTPAT  members  that  were  awaiting  initial  validation,  as  of 
December  31,  2007.  The  remaining  39.6  percent  (657)  of  members  certified 
and  awaiting  validation  were  non-importers.  Non-importers  represented 
60.1  percent  (3,778)  of  C-TPAT’s  validated  membership.  While  97.7  percent 
(3,692)  of  non-importers  validated  received  a  positive  result,  no  additional 
benefits  were  awarded. 


Table  7:  Analysis  of  C-TPAT  Member  Status  as  of  December  31 , 2007 

Member  status 

Number 

Percent 

Certifications 

(1)  Certified  members  from  program’s  inception 

7,948 

(2)  Certified  members  awaiting  validation 

1,658 

20.9 

•  Certified  Tier  1  importers 

1,001 

60.4 

•  Certified  nonimporters 

657 

39.6 

Initial  validations 

(1)  Initial  validations  completed  from  program’s  inception 

6,290 

79.1 

(2)  Importers’  initial  validations  completed 

2,512 

39.9 

•  Importers  awarded  Tier  2  benefits 

2,219 

88.3 

•  Importers  awarded  Tier  3  benefits 

233 

9.3 

•  Importers  suspended  or  removed 

60 

2.4 

(3)  Nonimporters’  initial  validations  completed 

3,778 

60.1 

•  Nonimporters’  positive  validation  result 

3,692 

97.7 

•  Nonimporters  suspended  or  removed 

86 

2.3 

Source:  GAO  analysis  of  CBP  data. 
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The  Government  Accountability  Office,  the  audit,  evaluation,  and 
investigative  arm  of  Congress,  exists  to  support  Congress  in  meeting  its 
constitutional  responsibilities  and  to  help  improve  the  performance  and 
accountability  of  the  federal  government  for  the  American  people.  GAO 
examines  the  use  of  public  funds;  evaluates  federal  programs  and  policies; 
and  provides  analyses,  recommendations,  and  other  assistance  to  help 
Congress  make  informed  oversight,  policy,  and  funding  decisions.  GAO’s 
commitment  to  good  government  is  reflected  in  its  core  values  of 
accountability,  integrity,  and  reliability. 
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